a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390

Analysis

max time kernel
10s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 10:30

Target

a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll
Size

314KB
MD5

bd49700df54c3d8d1ae13d41c1d56e13
SHA1

da525bc1f6d8748bcf6c660fa04659b22545bc06
SHA256

a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390
SHA512

e52a9e6bf181089f16d334ef6196b8b138106078c8798ed59e4ba013a0059f6cb61fae818895ca70049e427c0f87d050f46cbe10998ec3d71e8072937d065969
SSDEEP

6144:bYhYN9Lxf/xPavDUACjY7Vq+VKG9c3vTfyXN2SSf0vNz76JO1FZl/vJ:bYGb/xPav37Fwrfy9TeCFb3J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28
PID 788 wrote to memory of 844	788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll,#1
  2⤵
  PID:844

memory/844-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download