1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 22:28

Target

1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll
Size

36KB
MD5

ab492e8b62d60326b3c4ca03709efe00
SHA1

c1d69a3051dc37db0d9edb5654fd36bd37a3c6e6
SHA256

1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7
SHA512

9f2956e46444f5f963c1d7bb1c396db7cc7e636986e77bdf6bc682ede85130fca18d0b77f00f434b2f2c545c34ae5d1323fe77033edc3b7c5295ebe4f44b8982
SSDEEP

768:rWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:w1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll,#1
  2⤵
  PID:1112

memory/1112-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download