b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 06:09

Target

Netviewer.resources.dll
Size

1.3MB
MD5

8ada1585850bf3258b297eb2a2536dee
SHA1

8a42932ba407fc4736cd1e87b04bd8fe1e007b0e
SHA256

3d365d01532dc432304cb3ad87b4b86764c9dd8882b0e84beecdb62d1bb35d7a
SHA512

f0271dfa1ca42caeff6e1a96ce025c69d9027b0a4d7f456da0c2c466a04fc6093d52b3f7be04c922e892014e4da35399f77e9086040cd3c07e57d63ec027ad1a
SSDEEP

24576:6JEFdNOvry0NyuSOnjygOCnh3yD7HZZnvEzOV+gWTk5JEFdNMVEFdN:SEFdNOv7omjyRyhiDNZnvEzOMnkbEFdZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
  2⤵
  PID:1196

memory/1196-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download