96722a87de12d647e8c31834a02131d7c0e3cf9682176ee9d234413b733f65f8

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 02:05

Target

96722a87de12d647e8c31834a02131d7c0e3cf9682176ee9d234413b733f65f8.dll
Size

488KB
MD5

06a58dd66af51368ecf8b49948bd8a6a
SHA1

f4c3ee1b9a5e3261be49728e5bdc8c54ef9bea99
SHA256

96722a87de12d647e8c31834a02131d7c0e3cf9682176ee9d234413b733f65f8
SHA512

fb0056fd6b3d99cc9c77af691293b276d8657042e69b0697b072251bad65db31364dc1b9942284f23bacc22160bc9d4010cd80a336c94f2463cb7758f913d536
SSDEEP

6144:5doSityBcrECwzKPmMOSF1ck5z8GQvjxAAzV6b/fXrtcCzo06XF:nhOa7Cwve1c40vjx5Ib/tzsXF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96722a87de12d647e8c31834a02131d7c0e3cf9682176ee9d234413b733f65f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96722a87de12d647e8c31834a02131d7c0e3cf9682176ee9d234413b733f65f8.dll,#1
  2⤵
  PID:1880

memory/1880-54-0x0000000000000000-mapping.dmp

Download
memory/1880-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1880-56-0x000000004A800000-0x000000004A87A000-memory.dmp

Filesize
488KB

Download