ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:13

Target

ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll
Size

22KB
MD5

2ded9793ed5dcd3b35f1aa2b1a948c43
SHA1

7fa8fe6adc6f823b0d85c613ec606bb63c66a715
SHA256

ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798
SHA512

f24c3feed44d62585354ee2d59987189d7bacedc994ca157f7d2140ae24c948a3a4795d5aeed130ca7286474bbb85ddf8d2e9a0a1f3cae0269b60e17b0682ef1
SSDEEP

384:TeJu45MQ4DL1at6OatczF5ayVSy09BND/JzbqR8yEe5dB:M7W+6OatcFMmST9BNDgayE4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28
PID 776 wrote to memory of 1188	776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll,#1
  2⤵
  PID:1188

memory/1188-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download