6ec79179c1e61df21e38b754017b672d559f0537ce0a3b64afe7df97025fd01d

Analysis

max time kernel
1563s
max time network
1571s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 10:38

Target

DLL/MegaDLL.dll
Size

17KB
MD5

d904120b05f69c04f55f31f4a0c330db
SHA1

5e2c67cd8e0df64372b0f480eaa0bd2318d0af88
SHA256

9c344fc3b74cb0c407941f328817acc14af1958596f514081c22541d125f30b1
SHA512

34c70d7f14751c611a7ee28225535ba18025065a47c545d1cb14a6609ea5f5fe2b5e0e182bb7018d606e3afd2ae5970b1a1ff7b1034278c38949a924378f0f1a
SSDEEP

384:MnW5v2OkC4ksAG3qdDeGpmeyQQ1jtgzQ6jdO0uuokwawAO8wWsKMDc:kW5uOkisqdDBtKyk6jdOAFm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28
PID 2252 wrote to memory of 2092	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\MegaDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\MegaDLL.dll,#1
  2⤵
  PID:2092

memory/2092-0-0x0000000000470000-0x00000000004B0000-memory.dmp

Filesize
256KB

Download
memory/2092-1-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/2092-2-0x0000000074640000-0x000000007464C000-memory.dmp

Filesize
48KB

Download
memory/2092-3-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-4-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download