74e02b4c1d378ddf6d6a3044de54a4eaf17e96507d00310eab0c9b19d9873b07

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:36

Target

74e02b4c1d378ddf6d6a3044de54a4eaf17e96507d00310eab0c9b19d9873b07.dll
Size

198KB
MD5

e7671e61a357d63290fe7d0f807d41c0
SHA1

fd3e0e7210fac482ed6316577097f44c500cb075
SHA256

74e02b4c1d378ddf6d6a3044de54a4eaf17e96507d00310eab0c9b19d9873b07
SHA512

3b4bec1c00c134b269818af7086f1304bf1351ad91197936d04053cc70f72ffd12281098e3ce226532b76a4145d4d6679053ad818a25b90eb1be295be130d63a
SSDEEP

1536:E98D5dJERLy3MjjRNZb8ML8r3L7KcW6U0+UAjpWHw61rAlqWXBBUR1nZiCpwH:q8D5dSLCcdNZoPP7KckwLxAqABUnZlq

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 1736 wrote to memory of 620	1736	rundll32.exe	28
PID 620 wrote to memory of 1356	620	rundll32.exe	29
PID 620 wrote to memory of 1356	620	rundll32.exe	29
PID 620 wrote to memory of 1356	620	rundll32.exe	29
PID 620 wrote to memory of 1356	620	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e02b4c1d378ddf6d6a3044de54a4eaf17e96507d00310eab0c9b19d9873b07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e02b4c1d378ddf6d6a3044de54a4eaf17e96507d00310eab0c9b19d9873b07.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1356

memory/620-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/620-56-0x0000000000690000-0x00000000006C9000-memory.dmp

Filesize
228KB

Download
memory/620-57-0x0000000000690000-0x00000000006AF000-memory.dmp

Filesize
124KB

Download
memory/620-58-0x0000000000690000-0x00000000006AF000-memory.dmp

Filesize
124KB

Download
memory/620-60-0x0000000000690000-0x00000000006C9000-memory.dmp

Filesize
228KB

Download
memory/620-59-0x00000000006D0000-0x00000000006EF000-memory.dmp

Filesize
124KB

Download