cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:40

Target

cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll
Size

82KB
MD5

3a94a6c0a88c9ab931278d5df098822b
SHA1

2c6eea477d2184dc786ac1ab2c184299ca907a1e
SHA256

cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b
SHA512

e9d5458c0876fe03c8fd88c94f8e0e27322e84d4156dab574c951028d907aec87103a0b14e2eae8abea32623debb7dc4d4a4a0f8b00bfc74ed9f3b86d9273979
SSDEEP

1536:alo/VcENLJJ10quYOqgTEa/PNgpMzBbd8B4fmhA8mW2:aUlNlJ10FNlNg+sbO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll,#1
  2⤵
  PID:900

memory/900-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download