b9a424294a341d886ee39542674cc3d00735495082df3385b057ac16ac713516

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:55

Target

b9a424294a341d886ee39542674cc3d00735495082df3385b057ac16ac713516.dll
Size

30KB
MD5

528ffe7f38f542ab3f67956c218554ce
SHA1

6f06b7f6cb3ae025525828e7f5a029a25a59f08e
SHA256

b9a424294a341d886ee39542674cc3d00735495082df3385b057ac16ac713516
SHA512

c5cd6670fe0988bc096f1d17d709277171068e83c9e3eddbbaf8a593b00d64db907116f0d3fc71bd9c2d52dffda8129fbcf526e1bf110f7c42ca28b54e94dec6
SSDEEP

384:lAHxUS1qujNpKnGQmV2ltj88VtTGn4+L/P10cQ3bMV5wLqV7Ph/QPeQUX9kTwLq1:+KS1quZp0GQfrX+LPaToVLSK276XY3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28
PID 1880 wrote to memory of 1400	1880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a424294a341d886ee39542674cc3d00735495082df3385b057ac16ac713516.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a424294a341d886ee39542674cc3d00735495082df3385b057ac16ac713516.dll,#1
  2⤵
  PID:1400

memory/1400-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x00000000000B0000-0x00000000000BC000-memory.dmp

Filesize
48KB

Download