ef73c0077ffe2af13f0ea59a1a0f4d3c4851cd15978fa4581fd0000356fd8638

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 15:35

Target

ef73c0077ffe2af13f0ea59a1a0f4d3c4851cd15978fa4581fd0000356fd8638.dll
Size

167KB
MD5

ccac886204bdefd1265c3fbe360fc032
SHA1

0117d040620c7c80dd3279669d4ac7749ac0f924
SHA256

ef73c0077ffe2af13f0ea59a1a0f4d3c4851cd15978fa4581fd0000356fd8638
SHA512

36b0dcd3baeb633842a2df8414232121dbcc61a97225fbd135f87a8839ef64b6facdf07d217952795962389d84be66816302c7e3c4680ff9132c76efe5b5152d
SSDEEP

3072:cuzKPUNhkuM7LNpU+5hdLk7ydfdlxTxgr+rKqld3TyBTsaCIsB9VI7dOeDWuN:cuzFhkuQ3UmhdLou19g0KqfyTsaCo7AW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28
PID 584 wrote to memory of 876	584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef73c0077ffe2af13f0ea59a1a0f4d3c4851cd15978fa4581fd0000356fd8638.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef73c0077ffe2af13f0ea59a1a0f4d3c4851cd15978fa4581fd0000356fd8638.dll,#1
  2⤵
  PID:876

memory/876-54-0x0000000000000000-mapping.dmp

Download
memory/876-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/876-56-0x00000000000B0000-0x00000000000D5000-memory.dmp

Filesize
148KB

Download
memory/876-57-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download