caa0a10f82b5b2e92e201b0fe89a5cab7da82ff0acace6206b936b1b95368667

Analysis

max time kernel
19s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:33

Target

caa0a10f82b5b2e92e201b0fe89a5cab7da82ff0acace6206b936b1b95368667.dll
Size

22KB
MD5

67748c27fe7f4b47942c1a560bfff8e0
SHA1

8ae859b518c30cac9aed048100a7d7bbc9b85823
SHA256

caa0a10f82b5b2e92e201b0fe89a5cab7da82ff0acace6206b936b1b95368667
SHA512

619bf944fcdcc64ad10440e23e48b1b76e619b8f267957233bfdfabec228cd0e0e3ae6edaad312870544f7442114193e475b15608a5c629a60cfa117694242ef
SSDEEP

192:96BNWJ+Fs3qnZID0W9NzWLDU41PljFNtzck4Y9xM33YLjc1Mi6QNu8:96BNWGlZIAWfzWLDn3tzc2nc+i7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa0a10f82b5b2e92e201b0fe89a5cab7da82ff0acace6206b936b1b95368667.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa0a10f82b5b2e92e201b0fe89a5cab7da82ff0acace6206b936b1b95368667.dll,#1
  2⤵
  PID:848

memory/848-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/848-56-0x0000000071AD0000-0x0000000071ADA000-memory.dmp

Filesize
40KB

Download
memory/848-57-0x0000000071AD0000-0x0000000071ADA000-memory.dmp

Filesize
40KB

Download
memory/848-58-0x0000000071AD0000-0x0000000071ADA000-memory.dmp

Filesize
40KB

Download