04f94ca2ddf76ad8b847ad8e87cca90b3d3c75701fca16e847859a22626c857b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 22:11

Target

04f94ca2ddf76ad8b847ad8e87cca90b3d3c75701fca16e847859a22626c857b.dll
Size

36KB
MD5

c97f73165acdf7b83f16605e4a89ea11
SHA1

1f0002f242fec9543bd7d84aa3e745a0c1ba670a
SHA256

04f94ca2ddf76ad8b847ad8e87cca90b3d3c75701fca16e847859a22626c857b
SHA512

dc7eb438074b34d146ee1b97ac3a11038f66d76279f5605897d18a40b33bb6762eccb49f4c0b5d4fdd12602ef611819c6a643411b95ee2c355f4ce5de3c3ab13
SSDEEP

768:QWLnUr7ihkMWTzj/5BzUmj+moDBBQARQkTFwfdgo:XLUrwkD/j/5BzUcl4BBQARwio

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04f94ca2ddf76ad8b847ad8e87cca90b3d3c75701fca16e847859a22626c857b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04f94ca2ddf76ad8b847ad8e87cca90b3d3c75701fca16e847859a22626c857b.dll,#1
  2⤵
  PID:1748

memory/1748-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download