9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:11

Target

9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll
Size

100KB
MD5

6206aa4f1f068eb07f2178898c39af42
SHA1

e7e3d373f12050693502ea18f9bacc490c8af2ea
SHA256

9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49
SHA512

849dfd132cc8ecc167af2c1437ad80650e0949766c6eae6c9e2d4c6f024d542048c06fc110c52344e3f1d9ff7187c959d25345baed4ee23fe9cfbabd4fc75b21
SSDEEP

1536:fDpVWfsTqgpbD1pR0Fkvbs70zXqOJG9uXptp+6tIgaKxFISWedsXo4FYESM9:7/Rpf1p8kv5D1bJt7tISWrBmS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1172-57-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/1172-61-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download