99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 08:14

Target

99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll
Size

13.5MB
MD5

dd49932d0259e5a1454f7371c2219345
SHA1

1cb68ea08ff0409ee6fce6ece2520cfd76f4cb87
SHA256

99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813
SHA512

9e599817174fc784d52a11326b61c9957f02c12e3e07fa8b1e5c2641ccbc4aed210dd40fc4555907a9cdc9c9977971b0909f48dfe972c1fbed3496b760beedc7
SSDEEP

196608:7WwgQg3axeEjsCo0sFkVRDGwBdKpdqC7MRPOZnTYiNWvvRRYcOim7U03yX+enwkP:qjwdHjRGW4n57MEYV5RYTz75penwUr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28
PID 1704 wrote to memory of 1584	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll,#1
  2⤵
  PID:1584

memory/1584-0-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/1584-1-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/1584-2-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/1584-3-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/1584-4-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-6-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-9-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-13-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-17-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-21-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-25-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-28-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-29-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-30-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download
memory/1584-31-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/1584-32-0x0000000004E20000-0x00000000051E2000-memory.dmp

Filesize
3.8MB

Download