b27317d6a223bc78590e1861e2def000cdcac165cb7b245b3546b945aea631f1

Analysis

max time kernel
229s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 04:46

Target

b27317d6a223bc78590e1861e2def000cdcac165cb7b245b3546b945aea631f1.dll
Size

290KB
MD5

9a4e73b7d0907f0e54fd91bc83ad3d41
SHA1

035a0f931547c185d1d4073e7c2405a7f19e758c
SHA256

b27317d6a223bc78590e1861e2def000cdcac165cb7b245b3546b945aea631f1
SHA512

505333a6c07480fdc8d2dd4034c3e77c2607602c1cd1553b6a97dda2514b4bfe3e415894c4f3ecfbd5b24a213c50a1a1012136d6c0b7fb4030ce07eb405b0a8b
SSDEEP

6144:wiey3Mk2HNI+hg+6fkP7HFH7IWA4voZX9yzBqQNIQlIfQE5VnoOQby:xLWNI+hgZfkHuWAJ1OHWRb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28
PID 872 wrote to memory of 596	872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27317d6a223bc78590e1861e2def000cdcac165cb7b245b3546b945aea631f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27317d6a223bc78590e1861e2def000cdcac165cb7b245b3546b945aea631f1.dll,#1
  2⤵
  PID:596

memory/596-54-0x0000000000000000-mapping.dmp

Download
memory/596-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/596-56-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/596-57-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download