a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89

Analysis

max time kernel
28s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 09:35

Target

a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll
Size

14KB
MD5

3a2a85ff59762a65c39f3c88d0dc2e20
SHA1

9e91d02e3f8e48c098f33825dd216aaf0b70a09f
SHA256

a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89
SHA512

0c133cdf2253bfe25cce9150a1f78f89447196988323d088e554f4b4a5ebe2f92a21752113d904dac7a411256d0cd4218b08d88add5fbe24d883da3094f880c3
SSDEEP

192:aqQsndq08FEahMy1iJoWj6L6k0NVPaIzUOAbn7RqWsNWP2U:RkFEaJOoKUu//xAbn7RqWsNWp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28
PID 2044 wrote to memory of 1144	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll,#1
  2⤵
  PID:1144

memory/1144-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1144-56-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download