39b27d3988dc57d32bd22a9c1f7333a62a9534aab4cbd88e7561ea154ff6c150

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:44

Target

39b27d3988dc57d32bd22a9c1f7333a62a9534aab4cbd88e7561ea154ff6c150.dll
Size

380KB
MD5

a60b774a743e90344e0ceff7edf69c20
SHA1

0f1595f8d03dad611ddf0cc4d58d4ac6e88eadce
SHA256

39b27d3988dc57d32bd22a9c1f7333a62a9534aab4cbd88e7561ea154ff6c150
SHA512

bc5ebdbc287c109a074a537a6ba0501fbe7db3e4db2beb2dbb9ae98139730544332b6b9e4a6f1a94f4dff3e181f1eea6726e29de6d048a76f913b16e2ccfd3b5
SSDEEP

6144:ddoSityBcrECwzhPmMOSF1ck5zPxUWequYG:DhOa7CwMe1c4mWe0G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b27d3988dc57d32bd22a9c1f7333a62a9534aab4cbd88e7561ea154ff6c150.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b27d3988dc57d32bd22a9c1f7333a62a9534aab4cbd88e7561ea154ff6c150.dll,#1
  2⤵
  PID:2012

memory/2012-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x000000004A800000-0x000000004A85F000-memory.dmp

Filesize
380KB

Download