9464f93a7661e7ecdb7d14c6cb7f37b977ebee8a8cf8bb90e7f331623c55f3af

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:23

Target

9464f93a7661e7ecdb7d14c6cb7f37b977ebee8a8cf8bb90e7f331623c55f3af.dll
Size

88KB
MD5

a647a9df86ac5f44e8d334ad6b288a3f
SHA1

27da1ce04ac51669fe6f931c4a8d5ae0eb71986d
SHA256

9464f93a7661e7ecdb7d14c6cb7f37b977ebee8a8cf8bb90e7f331623c55f3af
SHA512

793c0a196bc8704c720ef403fa9d871d1569b655efa1fc4e107328dc1b77c98cd94eaeac8c59fbbdc55a54ec495655a129c69b55500c5ce1c1cbdf7386cabdda
SSDEEP

1536:9/ZK6JRFEEDxt0L1t0JAee40F6fKwBNt6J+LWXf:pZpJEEDx+L1t0eRwfKwpnLOf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28
PID 1620 wrote to memory of 1744	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9464f93a7661e7ecdb7d14c6cb7f37b977ebee8a8cf8bb90e7f331623c55f3af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9464f93a7661e7ecdb7d14c6cb7f37b977ebee8a8cf8bb90e7f331623c55f3af.dll,#1
  2⤵
  PID:1744

memory/1744-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1744-56-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download
memory/1744-58-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1744-61-0x00000000000C0000-0x00000000000C6000-memory.dmp

Filesize
24KB

Download