14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:27

Target

14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll
Size

90KB
MD5

6e1022b00cf9968ce532eb35a90e4d9c
SHA1

62f7aef54a7c6a949ea47d254699a7ad559a99d2
SHA256

14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9
SHA512

6609ed47adbc805bb4722562a24437c3738ef6c6b38e5f19dfc02346cfab335e730a263157c69cb04acd0052bf316f26de4430d8ef1a5eafdf80c700e05ae592
SSDEEP

1536:nylNPfcD+KZzd2vXmIzk9aoSfy2IdDKLHF4NCjUNk6xpx8jBrW8T4HlE98V:INPfvCzkvXnWifcROyKUNJxpxGS8TMlb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll,#1
  2⤵
  PID:1892

memory/1892-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download