222b3d375221a0df7c5691e09b8a7a2cafb4b63e393d699b980c49849bf4384b

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 10:01

Target

222b3d375221a0df7c5691e09b8a7a2cafb4b63e393d699b980c49849bf4384b.dll
Size

1.2MB
MD5

57a2c071e0c33df6c060fa40ce658136
SHA1

ced7a3262a425343e3b2bc7c29c0aacef1df4926
SHA256

222b3d375221a0df7c5691e09b8a7a2cafb4b63e393d699b980c49849bf4384b
SHA512

890e104665408a5061645e907e150386ed9d41a7237da590f06a841da73264b69c9ccc2961d2ee6498457ed35e7745815eb8048925f2def838db78993897847a
SSDEEP

24576:/xhc+m/Ym5yYfoy2db3WMZYayG96uLT4M2DTF15H878OFsO:NQ5+y2db3Wv69VLT4M2DTr5H878g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27
PID 1052 wrote to memory of 872	1052	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\222b3d375221a0df7c5691e09b8a7a2cafb4b63e393d699b980c49849bf4384b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\222b3d375221a0df7c5691e09b8a7a2cafb4b63e393d699b980c49849bf4384b.dll,#1
  2⤵
  PID:872