1e792027e657527130edaf292f14c8b3718c7227aca2b73ba6fd30001f2c1466

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 22:31

Target

1e792027e657527130edaf292f14c8b3718c7227aca2b73ba6fd30001f2c1466.dll
Size

33KB
MD5

fef4a9763ebba35bc8055c46647c5bb9
SHA1

9485f7c11c80c1f330ef317d9652e92cc1609997
SHA256

1e792027e657527130edaf292f14c8b3718c7227aca2b73ba6fd30001f2c1466
SHA512

0d509506f30df845ce53031d642593edb20da1831b0d6862ad9b3551e5364637bf1b15b54713a51f66a067a63ce5a6da7d64cc3c6b7dd343a0432512bb983c65
SSDEEP

768:GBC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+b:GBwgAEw0kY87EWddgWk+Rd+b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28
PID 1936 wrote to memory of 1384	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e792027e657527130edaf292f14c8b3718c7227aca2b73ba6fd30001f2c1466.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e792027e657527130edaf292f14c8b3718c7227aca2b73ba6fd30001f2c1466.dll,#1
  2⤵
  PID:1384

memory/1384-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download