12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093

Analysis

max time kernel
21s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 21:27

Target

dll/DLL_AnalyzeGesturesInRight.dll
Size

62KB
MD5

03890a9faa8613f47ef0a1932f1a875d
SHA1

e8ec231284c43a93c94e8750cffa551a66d9c276
SHA256

52d5e0a454325462c724038311462bb499096b037560b657b8c02870b929473c
SHA512

ecac97cb27de0495a62701e5498a8c67886336b32d03be4c97a4c00083b443780871a5e101917b352c313a37118059f011eda880eaadcb686d9a9d3a4bece112
SSDEEP

768:2+p3H9Jxq7To3/khDOARbhMEBWZIcBEnbRwkXGnTED8kKdmRZADvwD1:2+JHePaARtJnFw3XkKdmR6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2008	1852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_AnalyzeGesturesInRight.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_AnalyzeGesturesInRight.dll,#1
2⤵
PID:2008

memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download