c4c4498042cdd9c0c73de04fa88aca7683cb4a295ae182cc115b740b7208ac24

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:31

Target

c4c4498042cdd9c0c73de04fa88aca7683cb4a295ae182cc115b740b7208ac24.dll
Size

4KB
MD5

4ce9a0373bbe799db7c2e7a217cebc30
SHA1

cbd709bd949bf6ce4271e6db7a0de22c57f4fa73
SHA256

c4c4498042cdd9c0c73de04fa88aca7683cb4a295ae182cc115b740b7208ac24
SHA512

a3a5b3ddc718ea2cc1d7dd21ebf1e753b39ef9d1b30166c26c804af87dfdcbf036529419e3d11740d48c201f2db3dad035203a8d806bb06fb0225b98b4b0783e
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm96GAoWfkDX9x:PmkiIz8UZrQ0MhI/ITqly96XoWf0L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27
PID 1948 wrote to memory of 1904	1948	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c4498042cdd9c0c73de04fa88aca7683cb4a295ae182cc115b740b7208ac24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c4498042cdd9c0c73de04fa88aca7683cb4a295ae182cc115b740b7208ac24.dll,#1
  2⤵
  PID:1904

memory/1904-54-0x0000000000000000-mapping.dmp

Download
memory/1904-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download