36e9bb6b814dd7b5641ce2f5585af52958d5bd736e56f3fc43f9f271c43fa42c

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:26

Target

36e9bb6b814dd7b5641ce2f5585af52958d5bd736e56f3fc43f9f271c43fa42c.dll
Size

156KB
MD5

f7e554a9db9eb7ed4e4f969e53ee1e20
SHA1

1724281d25cf8e63e16da3e1860e562ff1bf4fa7
SHA256

36e9bb6b814dd7b5641ce2f5585af52958d5bd736e56f3fc43f9f271c43fa42c
SHA512

2717e91438df9e421faea79c1c8bdd6eb41dfe6c84bddee028a6b8108fe852a90d340cad949bedcff81a413b330b268092b6312159ce6c044b3a6a11c77c5d20
SSDEEP

3072:skyNwyLv/ENXtv7oEd7f9u/REgRFKyuuEZ3mjHw:sky28wTuW8ul

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27
PID 1044 wrote to memory of 1412	1044	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36e9bb6b814dd7b5641ce2f5585af52958d5bd736e56f3fc43f9f271c43fa42c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36e9bb6b814dd7b5641ce2f5585af52958d5bd736e56f3fc43f9f271c43fa42c.dll,#1
  2⤵
  PID:1412

memory/1412-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1412-56-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download