9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183

Analysis

max time kernel
34s
max time network
40s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:33

Target

9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll
Size

278KB
MD5

db19159e8e6b20ba6dfa9a2b7717fbd0
SHA1

a51f9d806b67333e1d29e6e46a620d1564d1bbe5
SHA256

9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183
SHA512

6d7d0076df9b12602799de7cf06470770faabe0323e66cd4cd7174e8df9a8525f4fb17e7c30435791ea721ccb67eecc0964f9bcd98461fc91826ca947a57372a
SSDEEP

3072:CDbbSetVGA86B91/W+bjcY3h3xrV0mxasoOHh6r:CDNXG/M91u+Tx3xrdasJB

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1260 wrote to memory of 1604	1260	rundll32.exe	28
PID 1260 wrote to memory of 1604	1260	rundll32.exe	28
PID 1260 wrote to memory of 1604	1260	rundll32.exe	28
PID 1260 wrote to memory of 1604	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1604

memory/1260-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1260-56-0x00000000001E0000-0x000000000022B000-memory.dmp

Filesize
300KB

Download
memory/1260-58-0x0000000000300000-0x0000000000320000-memory.dmp

Filesize
128KB

Download
memory/1260-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download