10862968fe8c9ba8a52709f6e49b2f768f263c5ab66a1cdbc08785959604c3ec

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-02-2023 19:33

Target

10862968fe8c9ba8a52709f6e49b2f768f263c5ab66a1cdbc08785959604c3ec.dll
Size

118KB
MD5

3b2e4ccb2e938078c61888e8ea2b8d09
SHA1

32b88e500553926e45a4d76cf5b993fa95164927
SHA256

10862968fe8c9ba8a52709f6e49b2f768f263c5ab66a1cdbc08785959604c3ec
SHA512

22a5f80d1fa856e792ae6ede6196255a18dc27cdb3cd10953a03e28364e570d9a03bb794b574e286c95d3983b6689e283d67e23a3950a4334e0ab914ad9f8ed2
SSDEEP

3072:Dc8uEVNGLKZgPwmyrb14a++ApZKS1XULNRaLlhDefVh:gFINGq314a+PFZR/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1964	1956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10862968fe8c9ba8a52709f6e49b2f768f263c5ab66a1cdbc08785959604c3ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10862968fe8c9ba8a52709f6e49b2f768f263c5ab66a1cdbc08785959604c3ec.dll,#1
2⤵
PID:1964

memory/1964-54-0x0000000000000000-mapping.dmp

Download
memory/1964-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1964-57-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1964-56-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1964-58-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download