36ea7419c9c4ef2330590eb5f3b6e23b28972ef5e4859133e2105cb205eecf37

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 13:43

Target

36ea7419c9c4ef2330590eb5f3b6e23b28972ef5e4859133e2105cb205eecf37.dll
Size

52KB
MD5

f7fa957d962af2fe620f185725a41439
SHA1

c59018762def87b2ad14ee9406c4ac076229a7ad
SHA256

36ea7419c9c4ef2330590eb5f3b6e23b28972ef5e4859133e2105cb205eecf37
SHA512

6f21a69230bdbe6cacf1ede859e3d1a9eee5fd4d779ef392a63f52902050e2baf8af24a4a9be520cbf5bb4df9203d8aea9d7ad1fd174c0bc97819496998cda00
SSDEEP

768:GZMTBFOfVsmVd5hoSCIJFrwHPjjM7VvUwD7ZAKQCPGx:PT8VLVd5hoSCIJFAPPnwhXG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36ea7419c9c4ef2330590eb5f3b6e23b28972ef5e4859133e2105cb205eecf37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36ea7419c9c4ef2330590eb5f3b6e23b28972ef5e4859133e2105cb205eecf37.dll,#1
  2⤵
  PID:1252

memory/1252-54-0x0000000000000000-mapping.dmp

Download
memory/1252-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download