12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093

Analysis

max time kernel
38s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 21:27

Target

dll/DLL_PenSuit.dll
Size

65KB
MD5

1f7ffea4dd13500622f1c2f8fcd6d173
SHA1

0246bbdf6581a5b97b575c81e37780c864f5abb5
SHA256

20925e5fc22342eefd2ec58b81953117ba26e7fc0e076b87bcbf7c80dfb4a52a
SHA512

7a5894e2b9a11e06e0f1bf983bd96425354273b668ceb1d3a4cf746f453cc99a60529753eea829daafd6a9f299bda6854b618dc68ad5ef3d6de552d6b96c66e0
SSDEEP

768:clJPR+sL58FaojXvR4zShfcTpkHhq/6EnJ9BlM1ED9n9n68ORpvAW2KrER:YNosLesufSkE3n/BNoKWzr6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1068	1056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_PenSuit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_PenSuit.dll,#1
2⤵
PID:1068

memory/1068-54-0x0000000000000000-mapping.dmp

Download
memory/1068-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download