d49af9cec9da8689d7f6a9978b427eec8f029f09ff061d0f96eb405069fa0909

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
06-07-2023 19:25

Target

d49af9cec9da8689d7f6a9978b427eec8f029f09ff061d0f96eb405069fa0909.dll
Size

176KB
MD5

444d06bb8a844aa117f1ab9a7cd562a0
SHA1

4d5a785368fdcfb0c6e115b960c6f90d531284ba
SHA256

d49af9cec9da8689d7f6a9978b427eec8f029f09ff061d0f96eb405069fa0909
SHA512

1c34b33679946fea8337d4bda26802086946d68473c15ca622be1014c8f6b7fadc36a39215c194c5521c3f16f89eb2032b51822b262e17324d3ab5159486481d
SSDEEP

3072:8vBJc+J9QDRbOl37xqcV4UzSdbRQdoP7raFEE8rgT6cYL:QdAtOlL14+SZRV7ra9D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27
PID 2192 wrote to memory of 1824	2192	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d49af9cec9da8689d7f6a9978b427eec8f029f09ff061d0f96eb405069fa0909.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d49af9cec9da8689d7f6a9978b427eec8f029f09ff061d0f96eb405069fa0909.dll,#1
  2⤵
  PID:1824

memory/1824-54-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1824-55-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download