349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 15:37

Target

349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47.dll
Size

5.9MB
MD5

a8d100b18a92e88834aa6b087007ea9f
SHA1

79214374fdb5192b7640a10987c19420ea92e4f4
SHA256

349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47
SHA512

9072f84f7555625d94e1267304feca313a2ebc4f4da61f136d571888960fef071e89192251179b2edc1d8d04d47dd9ab45fc5fa150654ca285e433e33d7ed968
SSDEEP

98304:53fFwyocjW+wBOJVurVxn4MACVVYxlOfz/2CU/CaypmCB0olEwOg1u1/9vk:QtcMDVtzYl4/2taayfBVlZOt1l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28
PID 2824 wrote to memory of 2352	2824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47.dll,#1
  2⤵
  PID:2352

memory/2352-0-0x00000000745B0000-0x0000000074B96000-memory.dmp

Filesize
5.9MB

Download
memory/2352-1-0x0000000073FC0000-0x00000000745A6000-memory.dmp

Filesize
5.9MB

Download
memory/2352-2-0x0000000073FC0000-0x00000000745A6000-memory.dmp

Filesize
5.9MB

Download