fe396135a42af45b7b68e856fe9a93a7100c5eebc4a5559f2aff218be79aaf37

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:17

Target

fe396135a42af45b7b68e856fe9a93a7100c5eebc4a5559f2aff218be79aaf37.dll
Size

250KB
MD5

729895c21ceb4afe6484177b1de84940
SHA1

8cdda912b573065acd380de66c3b1eeb3c245d23
SHA256

fe396135a42af45b7b68e856fe9a93a7100c5eebc4a5559f2aff218be79aaf37
SHA512

14d5f2b4af5ed4a15b6aadde1646ce086bef32d4ee428123ec36fa2efdedd5f5792b781bf5038cd45be506b145d6c95da42886064d62bf98f9350e19b80b40b6
SSDEEP

3072:fqskyxvfGLzH5WdAw0RqiqT+q6PWLvJn+4TlkUKlu3mEhO:BkQfCzH5cAv33l4TlkUHmH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe396135a42af45b7b68e856fe9a93a7100c5eebc4a5559f2aff218be79aaf37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe396135a42af45b7b68e856fe9a93a7100c5eebc4a5559f2aff218be79aaf37.dll,#1
  2⤵
  PID:1048

memory/1048-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download