9099147da7e0309cdb19a0ab8c7aa85489fded210d38253b2e572a3c6cf017ae

Analysis

max time kernel
31s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-02-2023 20:34

Target

9099147da7e0309cdb19a0ab8c7aa85489fded210d38253b2e572a3c6cf017ae.dll
Size

1.2MB
MD5

b95e93fa2f13a2a80655636ef274f4ca
SHA1

e4248f502fcdb4cc13fa5edb5f2b8043c339a08a
SHA256

9099147da7e0309cdb19a0ab8c7aa85489fded210d38253b2e572a3c6cf017ae
SHA512

159c30737095d4e7c275b8ece904b8c25a7d163c007be207edf08530e631dfbd272f5e048196aa65d16ec22dc4602761beb4ecd055a78449cbc54b0b96d34c87
SSDEEP

24576:4wYjVHTRhrKZ4gQs4YH6VpKyycmC5Ka1orU2aXdk4//OBxKjT:tEqZ4gfa3K736KDwNXe4//OBx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1528	1732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9099147da7e0309cdb19a0ab8c7aa85489fded210d38253b2e572a3c6cf017ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9099147da7e0309cdb19a0ab8c7aa85489fded210d38253b2e572a3c6cf017ae.dll,#1
2⤵
PID:1528

memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000001E30000-0x00000000021D5000-memory.dmp

Filesize
3.6MB

Download