c942db3b3c578aed07cceccc00209b67a98a6f8775b13627e88423d3753db3b1

Analysis

max time kernel
20s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:26

Target

c942db3b3c578aed07cceccc00209b67a98a6f8775b13627e88423d3753db3b1.dll
Size

35KB
MD5

54dc8eabeb276cdc90b44100356ecb90
SHA1

d425649cbdb8660a63343868955de067f21ef6e1
SHA256

c942db3b3c578aed07cceccc00209b67a98a6f8775b13627e88423d3753db3b1
SHA512

1265197a204a0af587576d7756f8ff904fdfc663a256c573d4e3d230a078d2dd6742d20867fb8945d8be610c22dbe7266dc8380d81dadfa1c8448bc85594b3db
SSDEEP

384:Dxw6CL9YMSyIS8st4rVUyzWTNk2/HysQgD77+6HTHICawCJFX9W+RkhfODYj:DHCSyIS1t4j2Z/tD7zH8ChwZ9vRArj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c942db3b3c578aed07cceccc00209b67a98a6f8775b13627e88423d3753db3b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c942db3b3c578aed07cceccc00209b67a98a6f8775b13627e88423d3753db3b1.dll,#1
  2⤵
  PID:1320

memory/1320-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download