7f0a9d49db15899eee04c37b5afb5f97c2b37aa1129ff40c62dc58804014da92

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 02:55

Target

7f0a9d49db15899eee04c37b5afb5f97c2b37aa1129ff40c62dc58804014da92.dll
Size

1.7MB
MD5

1497d8db6552acfe271b13748597672f
SHA1

6d14e1a924d363cce2e686245ddd67c5832c650a
SHA256

7f0a9d49db15899eee04c37b5afb5f97c2b37aa1129ff40c62dc58804014da92
SHA512

6341ac4a70c487bf34d9850d0d03688dbb08e40bf48e2257cb9927d2ff0494accc3b5819e2b62942b79b4249559cedf87bc5e961f78f055a32caa63a944e938a
SSDEEP

49152:8yt/qU37IUvOftm5I/KKxXWtml7+mTH7X:1tCS7IUv2ZGs5xH7X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2028	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0a9d49db15899eee04c37b5afb5f97c2b37aa1129ff40c62dc58804014da92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0a9d49db15899eee04c37b5afb5f97c2b37aa1129ff40c62dc58804014da92.dll,#1
2⤵
PID:2028

memory/2028-54-0x0000000074E20000-0x0000000075176000-memory.dmp

Filesize
3.3MB

Download
memory/2028-55-0x0000000074AC0000-0x0000000074E16000-memory.dmp

Filesize
3.3MB

Download
memory/2028-56-0x0000000000260000-0x00000000002AB000-memory.dmp

Filesize
300KB

Download
memory/2028-57-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2028-58-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2028-59-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2028-60-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2028-61-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2028-62-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2028-63-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2028-65-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2028-64-0x00000000027B0000-0x00000000027B2000-memory.dmp

Filesize
8KB

Download
memory/2028-66-0x0000000074E20000-0x0000000074E27000-memory.dmp

Filesize
28KB

Download