1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 23:28

Target

1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll
Size

41KB
MD5

3f39e11675605940de5b2669fa67dbdb
SHA1

d4937bd76cf1f7c2704d82bd4cc69a3c587f16f7
SHA256

1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f
SHA512

e07cb6f8f003d3938ce1f4093ae8212bbfeddb396167b1c8b3905747dcea91d0a26488074f03965b7d34f2ef914fb26109f462be11fde4e5717809db91f7edf2
SSDEEP

384:yjlbqr/fxQ0M9c9XNFtgHw36jYg2IIC3G974sD/77quBFdAAg+awpJKRkWXypTCW:mqbpQ0nPK6ID3Gj/7Hh2+hP6kWBJRoP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll,#1
  2⤵
  PID:1352

memory/1352-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download