db49f761f6e9b7c89e1c7a569cc5bbed398cb762b5c190daac286d1377d9c56f

Analysis

max time kernel
41s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 14:33

Target

db49f761f6e9b7c89e1c7a569cc5bbed398cb762b5c190daac286d1377d9c56f.dll
Size

109KB
MD5

d8216fe1052cf0375342a8df306b00ce
SHA1

760cad5b120cf5d2d6e3c1eac8231d607f4f3262
SHA256

db49f761f6e9b7c89e1c7a569cc5bbed398cb762b5c190daac286d1377d9c56f
SHA512

baa4f52075f7d3def5767e657599c381bef6c7d53645abfe138d691c9b47682425fd059cb24b7de8e7e7230b3fa09957c3dc99fb34fef1a8b71c6622f5e14e68
SSDEEP

1536:BCTwSV4SibNn8YIaT624cKau2f9d0uP3+Nvr+mHT:zS2SiuYIb24Wug9d0g+lr+mHT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db49f761f6e9b7c89e1c7a569cc5bbed398cb762b5c190daac286d1377d9c56f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db49f761f6e9b7c89e1c7a569cc5bbed398cb762b5c190daac286d1377d9c56f.dll,#1
  2⤵
  PID:1772

memory/1772-54-0x0000000000000000-mapping.dmp

Download
memory/1772-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download