99ca9a8e89395e20fe6c87ccf093ec0fb0d8d88f1644695bd9d5797f9362ad7a

Analysis

max time kernel
39s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:35

Target

99ca9a8e89395e20fe6c87ccf093ec0fb0d8d88f1644695bd9d5797f9362ad7a.dll
Size

100KB
MD5

e7b70edede4c13d51d4699ed580c3d30
SHA1

a91f6600b47ed8bf87b46b2ca4b854c3da21e387
SHA256

99ca9a8e89395e20fe6c87ccf093ec0fb0d8d88f1644695bd9d5797f9362ad7a
SHA512

bb77bc07f29c0f5a5f9741ca27a2e2fc69708e283fa3e52606ea8ee6a1b617c712dbec8cd0d534eaa347d7a1437e18cdb38ab29be554c42ef97690999b9865b0
SSDEEP

3072:/JfNzlU5+KtRmaQkUVaQL3rct+2rFGjaAHi0xn:/JfJER/QsQDrTqGGAzd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28
PID 1988 wrote to memory of 1364	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99ca9a8e89395e20fe6c87ccf093ec0fb0d8d88f1644695bd9d5797f9362ad7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99ca9a8e89395e20fe6c87ccf093ec0fb0d8d88f1644695bd9d5797f9362ad7a.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download