9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323

Analysis

max time kernel
225s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:46

Target

9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll
Size

178KB
MD5

772ed458fa8a90dc2e9ba4f265b50dc2
SHA1

dd474b60bb9c6db1d991356280d39e91e9ede9fa
SHA256

9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323
SHA512

f163b0c328605ed22e336e9ac2fb3a16cc80d1ca26a923fc9ec8e531ba3e081ef742e7eb60655fa96f6357b253601558f54b3244ed52919d5f9af524b030db27
SSDEEP

3072:a4Y4C2x9OenRhtFdBAXKasJZegPlP08aow8xHAbNRDkfMa96Pn8neR8DV:fxVx95PFJasZr/w2HAbNpGCn8eR8p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16
PID 772 wrote to memory of 600	772	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#1
  2⤵
  PID:600

memory/600-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/600-56-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/600-57-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download