4f383c4a70d9cf085323a53e8eae472a89e92603a9ab65eeaf031965a7fdfac1

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 13:39

Target

4f383c4a70d9cf085323a53e8eae472a89e92603a9ab65eeaf031965a7fdfac1.dll
Size

360KB
MD5

eb4580a5bcd74ed7e4e07edc9599d900
SHA1

1e2b4ca32369cd76a501c78a20f17772453ffe32
SHA256

4f383c4a70d9cf085323a53e8eae472a89e92603a9ab65eeaf031965a7fdfac1
SHA512

59d9490979ee0e8123cc70176336bad7c1e714cd71dc8c53c91d4f5c9bc59bd5a2aad19af63609a36f5ebdbce3d18fdb877fa2ced4b85675a4909945693a3c1c
SSDEEP

6144:PdoSityBcrECwzKPmMOSF1ck5zZOq0uhEG0zSoD:lhOa7Cwve1c4t0usWo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27
PID 732 wrote to memory of 1528	732	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f383c4a70d9cf085323a53e8eae472a89e92603a9ab65eeaf031965a7fdfac1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f383c4a70d9cf085323a53e8eae472a89e92603a9ab65eeaf031965a7fdfac1.dll,#1
  2⤵
  PID:1528

memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x000000004A800000-0x000000004A85A000-memory.dmp

Filesize
360KB

Download
memory/1528-57-0x000000004A800000-0x000000004A85A000-memory.dmp

Filesize
360KB

Download