f42687dc608fe7debb91f5b87e7965816622b779671df64a591bd0cf54ba10de

Analysis

max time kernel
231s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 19:43

Target

f42687dc608fe7debb91f5b87e7965816622b779671df64a591bd0cf54ba10de.dll
Size

56KB
MD5

44d21c880092b838203e0380728d562d
SHA1

93721aa82cd719208b54aee504c42e6c55cac3f8
SHA256

f42687dc608fe7debb91f5b87e7965816622b779671df64a591bd0cf54ba10de
SHA512

90ce5d46d505155f17b06a11c92a25dd29cdb0d12e931c0583272406fdb839445f8154a53106d3825b73b0f03e0bd528355b3bb5d8bc999482573fcb4107a937
SSDEEP

1536:JX4hJaitwjco3jZfq7/np/8Xe/l3erLnnCDvf:JCJAcozZC7/p/8Xe/l3e3nC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28
PID 600 wrote to memory of 472	600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f42687dc608fe7debb91f5b87e7965816622b779671df64a591bd0cf54ba10de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f42687dc608fe7debb91f5b87e7965816622b779671df64a591bd0cf54ba10de.dll,#1
  2⤵
  PID:472

memory/472-54-0x0000000000000000-mapping.dmp

Download
memory/472-55-0x0000000075151000-0x0000000075153000-memory.dmp

Filesize
8KB

Download
memory/472-56-0x0000000001D60000-0x0000000001E36000-memory.dmp

Filesize
856KB

Download