d38d93bbbf4ef91b5f3c611f38da40a9357fa3ebea44d80612e54408f964b185

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:30

Target

d38d93bbbf4ef91b5f3c611f38da40a9357fa3ebea44d80612e54408f964b185.dll
Size

34KB
MD5

97e161a268730b740a6f423777b929f8
SHA1

1d8187f0b74d0b76d12e909fd957fbfb7a15e679
SHA256

d38d93bbbf4ef91b5f3c611f38da40a9357fa3ebea44d80612e54408f964b185
SHA512

13c12c746259f17ebf6f7b9c82f1c5194f7c9d7fd39b05b03caeeb3dcb5e73194dd984c78b5dae5d9208c9a0be059125f91e4e683ebf3480862def6715672336
SSDEEP

768:ObOhTLYMpXQ3T3YNrZr//7WvkZCOqhnPmRZnX:WOhTPN/Nr17WvHpORZX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d38d93bbbf4ef91b5f3c611f38da40a9357fa3ebea44d80612e54408f964b185.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d38d93bbbf4ef91b5f3c611f38da40a9357fa3ebea44d80612e54408f964b185.dll,#1
  2⤵
  PID:1932

memory/1932-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download