dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 14:29

Target

dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll
Size

126KB
MD5

534fcff492cc54f0c26a28487c565bb6
SHA1

1861aa01d6c3b49e2fce26616f768ba3e031b146
SHA256

dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491
SHA512

4d5b52d1b2a14611c747c4117a2a098dc5c0627d453c55295a195320468bc72e26106476dacf694df4f29348cb2dc7d1455b0a05820b8dc20a83ff92538b2c07
SSDEEP

1536:AQxmkWtyMsaAkK1Q+vdwPPtS02Z2dSGkdAB9hPRO7rbEXKfyt4z0:otw51tcQCcBdAThw7roXKfHo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#1
  2⤵
  PID:1420

memory/1420-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1420-56-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download
memory/1420-57-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download