6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f

Analysis

max time kernel
37s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 16:27

Target

6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll
Size

96KB
MD5

3b7ec1a21ca1c445d404d51c85a2a08f
SHA1

3135f9cc209f459bfa449cec568054b41e12a78b
SHA256

6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f
SHA512

05cabed042ec440fc21635f5a2a9bfe78e4704b773da5a751282be805644a8d5bdff8310e55a12b1dd539e1386e6792a2feec20590bb79b0173b1c4ab582eb6e
SSDEEP

1536:1jbgsBJwMOdETcoEdmNqSm15xUyjED7T8s1Njj/unpj2g8rcBinj5+zzd:1xJXEkqSm3x63vNZgGnj5+zzd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll,#1
  2⤵
  PID:904

memory/904-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/904-57-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download