c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5

Analysis

max time kernel
35s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:46

Target

c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll
Size

212KB
MD5

b0817977ff095dbd84ada60e7f436b9b
SHA1

8e28f0ba7438d3e055e07f5c38a9f90726980b82
SHA256

c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5
SHA512

99008c3ca85c092ddf61db6ed2ad03dbf733a290c80f1a290b50b5cfcc4c1ab2bf02d856804fb703d07f46d16df76b216ddbb8dcb07f11fdb0ada8020675d854
SSDEEP

3072:xN8D1I4btSRqh2OuybQFqb1KV8eoLXvZ877IqM6dkoOs8IAOyqJqWTwffWNf:xmsdnLVuDv677IsdkPs8IApqo7ne

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26
PID 1852 wrote to memory of 2008	1852	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll,#1
  2⤵
  PID:2008

memory/2008-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x0000000010000000-0x00000000100B1000-memory.dmp

Filesize
708KB

Download