d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 14:42

Target

d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll
Size

49KB
MD5

8b0770e7f32ecd819b24da7c7d2ccb10
SHA1

57923f68e0852e6a0651a3320b6b1c4379a765af
SHA256

d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8
SHA512

9f072de319d2854771cf8eb0e99e87658989d6bd08734efff3621126f7125fdf997418629f51305540886cab765f0b3a9cfc5a2b4ffd3c16143546f62146f2a3
SSDEEP

768:gfYuRnW2voC7K88CpT6C7bGr6kqKFfVBwlFDxlDTH/Fxgmza4G6l:K/4woCzzpT6Cn6xBwPDrHwmDG6l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll,#1
  2⤵
  PID:1156

memory/1156-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download