deddcb42c50bf6653e38c21dacaa242d325139e4e9598dcd4639b0fc0c5418a0

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 04:53

Target

deddcb42c50bf6653e38c21dacaa242d325139e4e9598dcd4639b0fc0c5418a0.dll
Size

4.3MB
MD5

c3db4a3f10ed625daa2976b619f30411
SHA1

a3f2ad01fe9a3b8a8bcd0a456a6bd5b55db821f2
SHA256

deddcb42c50bf6653e38c21dacaa242d325139e4e9598dcd4639b0fc0c5418a0
SHA512

a36119a5106bec3f7641f7a1e71bc20cbe80bdd69fe13eed0ee695c6b68b977ae1f7370d124025e04f544074ef514bb80df94f004313ac08801877b299d35feb
SSDEEP

49152:/QRf3weoiHt6Dhnx0l8ndnBhX5oPk0rUoktBbn78NcYcGrY8VQmo8Tb1O:4RPwJiIVQ8dnBhpoJrjsF+cYJf4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28
PID 2388 wrote to memory of 1116	2388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deddcb42c50bf6653e38c21dacaa242d325139e4e9598dcd4639b0fc0c5418a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deddcb42c50bf6653e38c21dacaa242d325139e4e9598dcd4639b0fc0c5418a0.dll,#1
  2⤵
  PID:1116

memory/1116-0-0x0000000074CF0000-0x0000000075142000-memory.dmp

Filesize
4.3MB

Download
memory/1116-1-0x0000000074890000-0x0000000074CE2000-memory.dmp

Filesize
4.3MB

Download
memory/1116-2-0x0000000074890000-0x0000000074CE2000-memory.dmp

Filesize
4.3MB

Download