96be3e98794bfa90914e822f99376e584d46b220d5cdba4188a6e14e3589f8c8

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:52

Target

96be3e98794bfa90914e822f99376e584d46b220d5cdba4188a6e14e3589f8c8.dll
Size

48KB
MD5

7249040c2492b9d05e0646b7aa9e17ed
SHA1

f98e5cb08507ec48f37adf62fa82a72d52e509a9
SHA256

96be3e98794bfa90914e822f99376e584d46b220d5cdba4188a6e14e3589f8c8
SHA512

82ae6565b83a138c6e8cd52089b6a354486984b56e2c3c2fad005bbdce4ad376b27081caf5c654f51d835a606e9a813fb21a4276f1ee88d38e38f88b9a982fdb
SSDEEP

768:bXPbE7StiKmiNTgNPJOsWRbMArCdpPuljSsBBQARQk0+EqUiSEd0XaX:b/YOvNTEYSsBBQARkjqUiSEdp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28
PID 1780 wrote to memory of 1000	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96be3e98794bfa90914e822f99376e584d46b220d5cdba4188a6e14e3589f8c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96be3e98794bfa90914e822f99376e584d46b220d5cdba4188a6e14e3589f8c8.dll,#1
  2⤵
  PID:1000

memory/1000-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download