93ae4bc03f94a5917c34a17a1fa1aabb37db6ecd8d2375b6f784a3308566f4ab

Analysis

max time kernel
40s
max time network
177s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 22:03

Target

93ae4bc03f94a5917c34a17a1fa1aabb37db6ecd8d2375b6f784a3308566f4ab.dll
Size

33KB
MD5

fc89a1ac5f33145dfc6a8213ad301300
SHA1

a1bb341fa68348871c30e60e9fc3afe1544c23b4
SHA256

93ae4bc03f94a5917c34a17a1fa1aabb37db6ecd8d2375b6f784a3308566f4ab
SHA512

f59704bbda73cbed569c040748b369f30d91501a3c8dfd6fd2ed98bd89f16d14fef6964491296607c4311604ee8d72e2a65a13d3ca350ad7f9021468586dd2ac
SSDEEP

768:uOsLdwWpo5YPa1kHNNv7orpGhB7cOplvR05:XsLdcYPxt17orpGYUvRe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28
PID 1416 wrote to memory of 2008	1416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93ae4bc03f94a5917c34a17a1fa1aabb37db6ecd8d2375b6f784a3308566f4ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93ae4bc03f94a5917c34a17a1fa1aabb37db6ecd8d2375b6f784a3308566f4ab.dll,#1
  2⤵
  PID:2008

memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download