38908f998446f9e24fce3e2accd4497a2ab84aff36844a235e5b75d054413a87

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:35

Target

38908f998446f9e24fce3e2accd4497a2ab84aff36844a235e5b75d054413a87.dll
Size

4KB
MD5

e66d04758adc6e08e90980462a0c1d20
SHA1

d4b8a21b985d2de6bf52e0bc2bacf8b79be0580f
SHA256

38908f998446f9e24fce3e2accd4497a2ab84aff36844a235e5b75d054413a87
SHA512

f2638b58ad12eaabf50904615df667436ece1998bfb7845cdc31da5b951df7109434174668b8282fd74f341fe20f949493f1b846142bd9225eed7ad1fd7acda5
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Lz3LcwjFTmXx4WqgfE1Aql7jBn5jEQ7bN:TRphMzf8cwj0hfIbHZ5jEQ7bQc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38908f998446f9e24fce3e2accd4497a2ab84aff36844a235e5b75d054413a87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38908f998446f9e24fce3e2accd4497a2ab84aff36844a235e5b75d054413a87.dll,#1
  2⤵
  PID:1080

memory/1080-54-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download