d2b97cf83fbd2b1944e1ecdff137694ebff296ad6c39dbf1401b711dc230e995

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 17:18

Target

d2b97cf83fbd2b1944e1ecdff137694ebff296ad6c39dbf1401b711dc230e995.dll
Size

16KB
MD5

fdf4cdb63f07f6cf4a86fdef01d53860
SHA1

78a5f10f13cc9b2269d8737d9eafd1a2b4b4b48a
SHA256

d2b97cf83fbd2b1944e1ecdff137694ebff296ad6c39dbf1401b711dc230e995
SHA512

8688f634595e20c37db7fe09d2517f6e3492a66fbf3fb1a0636d939a5bab6330990b28031ce295ca90ae6b61225b3bcc4958aa54420f39bfb2b1aab407399aeb
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKZ:JT0qmznB6rwUmRvRg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28
PID 1992 wrote to memory of 1788	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2b97cf83fbd2b1944e1ecdff137694ebff296ad6c39dbf1401b711dc230e995.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2b97cf83fbd2b1944e1ecdff137694ebff296ad6c39dbf1401b711dc230e995.dll,#1
  2⤵
  PID:1788

memory/1788-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download