7328aa5eaefbedf6beb93d26140ac4893d1f99a4acc95ba4968c162775d2ff88

Analysis

max time kernel
16s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 10:47

Target

7328aa5eaefbedf6beb93d26140ac4893d1f99a4acc95ba4968c162775d2ff88.dll
Size

95KB
MD5

6a3aa2c145f137e62214b191a3da6826
SHA1

455b7bb3771b4277cc8bb88d4dd4d6d423cd4d0c
SHA256

7328aa5eaefbedf6beb93d26140ac4893d1f99a4acc95ba4968c162775d2ff88
SHA512

55e69fce1ed1b3ea514cf251efa2f9dcc08269a682ff55fae53079b4ba360f55be599b0a89d7f5b1c5827ef9e985e2c521cb9aaea09dbfc8a18655bf56a54b6b
SSDEEP

1536:7wqVQayjYwizNh34jnl1DGryhSW0r21x:pny8Hxh347l1DsyOrUx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7328aa5eaefbedf6beb93d26140ac4893d1f99a4acc95ba4968c162775d2ff88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7328aa5eaefbedf6beb93d26140ac4893d1f99a4acc95ba4968c162775d2ff88.dll,#1
  2⤵
  PID:1128

memory/1128-54-0x0000000000000000-mapping.dmp

Download
memory/1128-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000000170000-0x000000000018B000-memory.dmp

Filesize
108KB

Download