91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:26

Target

91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll
Size

108KB
MD5

e46a5660131404fa71a6f9f2e672b344
SHA1

b7523be159f92fe44295ae517a73babe9439fe16
SHA256

91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994
SHA512

523054acb79c69ce4d88a6d4f82bfab0694b7b155322beeb2aca9a693351a7150b58630ffe0093e1aaacae4fe5f95d2e22e47b731cc6ab0d47eefc061ef5b96f
SSDEEP

1536:TD6K271gp7DXHQ49AmcM3UwAGFhtCUZCdgNg/9ZlBfZ9rwEIL30:TDGYLww/cMEwAGFhtAdUgl39rDILk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll,#1
  2⤵
  PID:1948

memory/1948-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1948-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1948-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download