939e293a3f94ad57efad5859dd7015c9f32271f7789d718f30af3c36551527df

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:59

Target

939e293a3f94ad57efad5859dd7015c9f32271f7789d718f30af3c36551527df.dll
Size

405KB
MD5

e4d87585d48fbf0fe1c4405d329431fd
SHA1

799a2079caa0014509acaf599661a1f7ee1fd6cf
SHA256

939e293a3f94ad57efad5859dd7015c9f32271f7789d718f30af3c36551527df
SHA512

1359ce285c774fad4fcf85489dc1a1c741ec710e9283c2c473fcf84626e4ce1ba546a8758e1e489880277945b0cce64ce191b95665d068cbff7c365486429fd8
SSDEEP

6144:zCi7xSLBAMmWyhwjZ3tflFNdzhznPOQc1+eKep9MepNZBovdWSG8ubl:d7xKBAMm/w5rPOQEQepxovsSa5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\939e293a3f94ad57efad5859dd7015c9f32271f7789d718f30af3c36551527df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\939e293a3f94ad57efad5859dd7015c9f32271f7789d718f30af3c36551527df.dll,#1
  2⤵
  PID:2044

memory/2044-54-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000820000-0x000000000088A000-memory.dmp

Filesize
424KB

Download