dd29d0cf724a07c919c3c830b8d297a819ea014b316bb0d5cd39958d167589cc

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:51

Target

dd29d0cf724a07c919c3c830b8d297a819ea014b316bb0d5cd39958d167589cc.dll
Size

472KB
MD5

ec16c56dd4a35bbbb3e7b9adb353c2a0
SHA1

7d59b2bca5baf3c5f7318fc3808928137c45b6fa
SHA256

dd29d0cf724a07c919c3c830b8d297a819ea014b316bb0d5cd39958d167589cc
SHA512

77e67f752527e7cc0852a05e6a6523fdf5c0bd7d36fc7bb585eeb919e6aa9b5481ba61ad4ebac4f4e7c13fae340a8d4dc35b2e3884fe2fe8d192315535a7c6fa
SSDEEP

12288:dE/Tmk6VLwTaQRrq8UcqvWn49lCFwyOyzJ:dE/CW3rqDUnYlCCyd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd29d0cf724a07c919c3c830b8d297a819ea014b316bb0d5cd39958d167589cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd29d0cf724a07c919c3c830b8d297a819ea014b316bb0d5cd39958d167589cc.dll,#1
  2⤵
  PID:980

memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x000000005BD50000-0x000000005BDC8000-memory.dmp

Filesize
480KB

Download