9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af

Analysis

max time kernel
35s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:12

Target

9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll
Size

265KB
MD5

4817b253fa1834689826d74ce601db8a
SHA1

84cf5a39c1f9cb8201f7f31d865de239e7e11adb
SHA256

9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af
SHA512

ef65f183ba81ffb70794c9d771db063d2a9bd2fcc982934c7a2f06ac79e756552f8996f34a750db5339a7f08dc68da67a3c7e8e5b1532937f6af695608593373
SSDEEP

6144:ENiU5dL835YgJxyY2ZYXTy1G86ELPw2Z5ompbidxHbdZvGQU:i5dL835YgTn2ZYDy1xVPTxidxHTvGQ

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1956 wrote to memory of 1712	1956	rundll32.exe	29
PID 1956 wrote to memory of 1712	1956	rundll32.exe	29
PID 1956 wrote to memory of 1712	1956	rundll32.exe	29
PID 1956 wrote to memory of 1712	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1712

memory/1956-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1956-57-0x0000000000653000-0x0000000000688000-memory.dmp

Filesize
212KB

Download