0fed9527ecfde26c1eab8b274293eb473393f365fcba4674267198225dec5aec

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 23:19

Target

0fed9527ecfde26c1eab8b274293eb473393f365fcba4674267198225dec5aec.dll
Size

32KB
MD5

54b15a99fa24f250ea093becc6a5d216
SHA1

beee429c50e4ba196b8864e6d5154556bfc177fc
SHA256

0fed9527ecfde26c1eab8b274293eb473393f365fcba4674267198225dec5aec
SHA512

21a90a8500cafa25fd8e7fd919c7a0707248812cce39854bc7c6b952fea0c6bb9249ff0923547ac418cb9a6f1bde21d7c08c877ba2596a61e07fa7d7cc522bf6
SSDEEP

384:WUIsK3EA9NMG5YBPUi9MY9zoDpb77+/VZSXGQG9aFJFrWCRIFDRW14:6sKUTeos4MY9zqb7QZkGZ96BTRItRW14

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fed9527ecfde26c1eab8b274293eb473393f365fcba4674267198225dec5aec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fed9527ecfde26c1eab8b274293eb473393f365fcba4674267198225dec5aec.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download