dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 16:07

Target

4cf63b9a3e4bc0910af4d8baa5939238.dll
Size

89KB
MD5

4cf63b9a3e4bc0910af4d8baa5939238
SHA1

361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256

dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512

177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38
SSDEEP

1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU43aB89p:UoUCWbBNpplToUs1uNhj25LJUOaB89p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1632	1108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cf63b9a3e4bc0910af4d8baa5939238.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cf63b9a3e4bc0910af4d8baa5939238.dll,#1
  2⤵
  PID:1632

memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download