fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245

Analysis

max time kernel
210s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:07

Target

fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll
Size

82KB
MD5

78262250514fc01e9899326fb2e190e0
SHA1

04a4d35633c9514756e1e88e667b7f14db8efc50
SHA256

fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245
SHA512

de23c13185dc63a6e594e2fa8137b8c9cb8afd2cfae8efca880e3d44efc1b0a6374081ee076aafb99f590e7e97c01841ee508548ae07babc19eda201ebaa2d05
SSDEEP

1536:KGkqG5zIpP27FvUa/fkKUzHFAKPueT3Q9Mej8P5CaqE3yseJj:K+kRUa/f/UpAKP1TLejw5ByLh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll,#1
  2⤵
  PID:540

memory/540-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/540-56-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/540-58-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/540-57-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/540-59-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download