79e49c8a8caebcc89bfa4a57767057b619f339f6884e13ce847da391f81e217a

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:32

Target

79e49c8a8caebcc89bfa4a57767057b619f339f6884e13ce847da391f81e217a.dll
Size

8KB
MD5

4ff6c5204673f8b6cd98a1518869ca80
SHA1

b1a2aedebc2b5f5161162c2aefaecb9a20aa56fb
SHA256

79e49c8a8caebcc89bfa4a57767057b619f339f6884e13ce847da391f81e217a
SHA512

bfc8fc16eb739a5f1d2aceb0da8a5acb3888aee9610114ca6060c00935b131946ca2e31db6253b66c90044191dbe58deef1ae6545117fdac4bdb3c89a1ec79cd
SSDEEP

192:FTiS+siZJMAUFwwn/kdgnW/767jge7wc07tQ+AxpwQIqZrwc4swZC:FSI9/kdg2cPV2C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27
PID 2012 wrote to memory of 576	2012	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e49c8a8caebcc89bfa4a57767057b619f339f6884e13ce847da391f81e217a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e49c8a8caebcc89bfa4a57767057b619f339f6884e13ce847da391f81e217a.dll,#1
  2⤵
  PID:576

memory/576-54-0x0000000000000000-mapping.dmp

Download
memory/576-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download