344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:16

Target

344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll
Size

53KB
MD5

f7fd428fac02a8e8ba86857e168c6ad8
SHA1

adbfb1217155bd088065ef7817d365aa8303c327
SHA256

344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620
SHA512

9724ab1dea8fd984e25b0cc6f842717fe080bfd858170de545cf65eeb7e3bfd75eb86ad4c4b2b0a2568cfc742e8d7404b90dc491e17b39e97982eb5d53e0b036
SSDEEP

768:Gx4m7JNSll3dTG+3rZ0yb4wRgOGsyRKuZFQ26ofg5F1gFLC4+y+uA1:Bm1NGJVGWZ94w4FKu3n45t4+xuA1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll,#1
  2⤵
  PID:1488

memory/1488-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download