c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 22:53

Target

c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll
Size

30KB
MD5

b3cd2b2f1ea2967307b8f963f9494e9a
SHA1

934c8cbe6b022d0bd036b8c9f254f2c954f314bd
SHA256

c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5
SHA512

bfe0959b8cf20095263b552b182a5871d73ed8232e37884d1daca84fdda6addf6f7bd2dacfaed87aeaf5ca16bad4b00c3bfba163e3300281bcef107c5da1161d
SSDEEP

768:GzIRK55ozOYcxVx6RO6+uU3EczET2NX2vBf4pkuHz:GzIg5o1uVx0OjUlT2NXiUkuHz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c170eaed861cdc1e92f45a99e7d1986d6c1318f3c41e0bf8b00a2c12f065a5.dll,#1
  2⤵
  PID:744

memory/744-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/744-56-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/744-57-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/744-58-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download