90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5

Analysis

max time kernel
42s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 07:43

Target

90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll
Size

37KB
MD5

2e176f85b516380ece489ab0e6261967
SHA1

3c85fdeb9e424d3309519791c69f4a37fc862caf
SHA256

90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5
SHA512

18b35562260b5c0fd87236809a9d5d9384231d64326cbc58033547e02c48d2d8ae72baa4d48675a5b8f0cf6d087d1ef7aeab07a6554dde06cc5b860059ab0e07
SSDEEP

768:dzR5dEf6S9BxCIPLqgADFJwe/fOjBeDr/qNlDLdE:daf6S9WoNADFJNy4DYDR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28
PID 1360 wrote to memory of 1800	1360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll,#1
  2⤵
  PID:1800

memory/1800-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1800-56-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1800-57-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1800-58-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1800-59-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1800-60-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download