a92d87043c21b12db3245582d9622b58b09708c8a598ea4dad310ee3b1bf2f4d

Analysis

max time kernel
65s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 09:43

Target

a92d87043c21b12db3245582d9622b58b09708c8a598ea4dad310ee3b1bf2f4d.dll
Size

27KB
MD5

6931af346374af202d3e5e1ac032a520
SHA1

cce5c6f97bf2b43507e4af56587369e3d801cc00
SHA256

a92d87043c21b12db3245582d9622b58b09708c8a598ea4dad310ee3b1bf2f4d
SHA512

1652ec994ec6654a6cbf978a6987f96c0f4b5d1dc605f4db401a8435fd95aee7b61519f04cf7a2320d920478f92adf695881016b39fff669069fb1eebd2ef754
SSDEEP

768:p5hctcjsCvbx2928QBO309QerRnggfhz3G:/C+jsCv/8QBO32lggfhz3G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a92d87043c21b12db3245582d9622b58b09708c8a598ea4dad310ee3b1bf2f4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a92d87043c21b12db3245582d9622b58b09708c8a598ea4dad310ee3b1bf2f4d.dll,#1
  2⤵
  PID:1880

memory/1880-54-0x0000000000000000-mapping.dmp

Download
memory/1880-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download