d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:12

Target

d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll
Size

44KB
MD5

e28373fec5fb37bdb5f9b3eafb5de662
SHA1

abff906ff4145cb650225841cb6ab58d7e04c833
SHA256

d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9
SHA512

464187ada46f02f4e859ca590f118366c2586bbb01045b7302dbbe8d9f4fd1bb251c2efa66377120d5955186efc0164805a72980a31bb2804315ae4d8375fc2a
SSDEEP

768:cVV7m2JvWSRAHYKoGyYQQNBeJXlK51GBM2hBBQARQkeElA/:2VXRAnGBM2hBBQAR9C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28
PID 2004 wrote to memory of 1900	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll,#1
  2⤵
  PID:1900

memory/1900-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download