c31dc963261ac4bd3bccbe36f6dd94d28b380aa9e97cb0a9dc87c2c90908870b

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:51

Target

c31dc963261ac4bd3bccbe36f6dd94d28b380aa9e97cb0a9dc87c2c90908870b.dll
Size

6KB
MD5

67fa3ea7828d7566ec9f75c2b3d8e230
SHA1

4062bd50322c43a1e3b9767fee104400dec600fc
SHA256

c31dc963261ac4bd3bccbe36f6dd94d28b380aa9e97cb0a9dc87c2c90908870b
SHA512

392378265ebedc1a6f311aa5ad6fee4fe5c4f5cb19dacbe056455a87848aa69fb8e298287ed6161396494b50b8a7fdeef86433d9bc234c16cce3f37ed091ab4f
SSDEEP

48:a5zjMTGcITBVQVE1lcJGv5dbnIvyG3A9y93sZJTvsZEvdpTbyA02n6XypV1FyyVT:iT3Qu847b2YP027bFp8nmc7ngO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c31dc963261ac4bd3bccbe36f6dd94d28b380aa9e97cb0a9dc87c2c90908870b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c31dc963261ac4bd3bccbe36f6dd94d28b380aa9e97cb0a9dc87c2c90908870b.dll,#1
  2⤵
  PID:544

memory/544-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download