d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:49

Target

d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll
Size

242KB
MD5

068812135d4a3658d55c712734962e95
SHA1

a8c9b02fc96e463c44620167cc99d70c58571a0d
SHA256

d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112
SHA512

a810eb0ce950553aa5f79ed01718b33fa9cf75155652e4b02abcb6d7a4616c0491bc6841301b44f612b54de6d0ddcf50d09ed9b3e3e6e2f051483e32f07e4a82
SSDEEP

3072:OoyxvfGPCXZsxMeZMN+ckS9drqnS20YVbQ3uiShzulSgvc:OoQfW2ZsSeiLYVCuisWvc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download