93be0882292fd64fa715e9e15c08fc7de8217f5cbc5a2e4f4950992c01514db1

Analysis

max time kernel
32s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:37

Target

93be0882292fd64fa715e9e15c08fc7de8217f5cbc5a2e4f4950992c01514db1.dll
Size

6KB
MD5

e3559d6ef5fc76c5be0f203c419fb850
SHA1

29a6ff174a30ca4221e3bdca09faafba9241a895
SHA256

93be0882292fd64fa715e9e15c08fc7de8217f5cbc5a2e4f4950992c01514db1
SHA512

7f5965c6e88b4fe12ab2484f8f754955eed612acb6a6f8789dacce31e0836cddc008fd661cdc91299f666a2eece053a95ebda5d6955ffd2fa18564219660e767
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7DfE:nGTWJGp0UZUd6378snt7DE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93be0882292fd64fa715e9e15c08fc7de8217f5cbc5a2e4f4950992c01514db1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93be0882292fd64fa715e9e15c08fc7de8217f5cbc5a2e4f4950992c01514db1.dll,#1
  2⤵
  PID:1984

memory/1984-54-0x0000000000000000-mapping.dmp

Download
memory/1984-55-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download