f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6

Analysis

max time kernel
9s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:56

Target

f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll
Size

238KB
MD5

4d0db34bfa38cfc8479280cb46622906
SHA1

55be91550a8f876360014eca6f5338993f3c489f
SHA256

f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6
SHA512

647c6d0ca9b9c6ad909894a69aa1f2c9fd677f48310e262aff36fe68423e0d012d037c5ba4d732d51b353ea98cae0d57968954e8bd5a1d15c50e89e22222ce8d
SSDEEP

6144:0wJsIZmcvLuairikfB9IiYRMpAcsXlny3j/jnUEZjHNp8O:zZmcqairJ59sCpZsp6nHJtN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll,#1
  2⤵
  PID:912

memory/912-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/912-57-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/912-58-0x0000000000720000-0x000000000075A000-memory.dmp

Filesize
232KB

Download