6ef7bdbea00c1335915d0988949b9a1462246bca88bd0be64ea4845f6e97734e

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 10:57

Target

PPsxtqiU.dll
Size

11KB
MD5

3e453c0403386520e8859208cda230fd
SHA1

605e2a2cc92a5166de5bc4b748a59f846730d87d
SHA256

6ef7bdbea00c1335915d0988949b9a1462246bca88bd0be64ea4845f6e97734e
SHA512

cfbd7f0b19b177f96499af9d80d89644e2fc8bb592fe42e6b57bfb8c750f5ed4d39c5ffd7cdb481ca364363cebb7527ed6b2e4865a1f9a28746bddc7c8fe57ca
SSDEEP

192:ZK+sw++5xoYFBX3es2NNPT3crn6BGObeqq1Ae0ShIW1vUs9WW+LF+sjOYuyHPkw:Jt++5xpb3zKhMjlHR0cUsuLFV0yHPkw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28
PID 1676 wrote to memory of 112	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PPsxtqiU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PPsxtqiU.dll,#1
  2⤵
  PID:112

memory/112-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download