fd2ff41e059d3271a1d27a8f4626095a91081608bec20b3807772d4cd7b2b092

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 03:35

Target

fd2ff41e059d3271a1d27a8f4626095a91081608bec20b3807772d4cd7b2b092.dll
Size

60KB
MD5

5a77c3fe751b9844783dfe7426a5760d
SHA1

7ea27a1d7fc067802398e4b5547533bacb1daed9
SHA256

fd2ff41e059d3271a1d27a8f4626095a91081608bec20b3807772d4cd7b2b092
SHA512

a51dbde3e999f30b44965c74fc7c1f712e35c5f5269f5d8f055acbe5870fe08dd356eb3a00a456c33d0bcdbdd88039ce277251a6c3aad86cf38c146c98850d19
SSDEEP

768:N0pPYH8Ho0TMXEOyNN/M0ZSsElFi8o96e:T0o0TA9yNNMAwRoke

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28
PID 1948 wrote to memory of 1148	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd2ff41e059d3271a1d27a8f4626095a91081608bec20b3807772d4cd7b2b092.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd2ff41e059d3271a1d27a8f4626095a91081608bec20b3807772d4cd7b2b092.dll,#1
  2⤵
  PID:1148

memory/1148-54-0x0000000000160000-0x0000000000171000-memory.dmp

Filesize
68KB

Download
memory/1148-55-0x0000000000160000-0x0000000000171000-memory.dmp

Filesize
68KB

Download
memory/1148-56-0x0000000000160000-0x0000000000171000-memory.dmp

Filesize
68KB

Download
memory/1148-57-0x0000000000160000-0x0000000000171000-memory.dmp

Filesize
68KB

Download
memory/1148-58-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download