dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 01:05

Target

dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll
Size

84KB
MD5

f89bccec2d793bf07bda77cbf9b9d190
SHA1

5918320f07b99ca7b2f3292b5e5a1403cf5599c0
SHA256

dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297
SHA512

085e66893a5f0db73f27130dbc7fe3db4ddc4d46a375c0a700bc1b7f05633e29d10c6f2cca0253a6d2261b2779d549d7fc0c95ba0e14a73dc546b4f2de25f77c
SSDEEP

1536:AAMCxhV0vxuF9W+UfA9dncXk38His8xu983g/vgSs:td0vsqfA9dn0k3q8xA83MvW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll,#1
  2⤵
  PID:844

memory/844-54-0x0000000000000000-mapping.dmp

Download
memory/844-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/844-57-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/844-58-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download