e80933e096880fae168052f195981c2fd1d4243511d6a0c88f17088a1e1a0350

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 22:05

Target

e80933e096880fae168052f195981c2fd1d4243511d6a0c88f17088a1e1a0350.dll
Size

18KB
MD5

6e8e70ae5be096e5ce7fbfea0554ce6f
SHA1

1a9228b29fd4b0d75b493fe755e3f4e1bf244e05
SHA256

e80933e096880fae168052f195981c2fd1d4243511d6a0c88f17088a1e1a0350
SHA512

da73c43281935269513230531599ff52c8e18a32d859cddb7ad6c18b328400091c1bcfbd4e247ab09b7da4ccc94c1e0372024611b2addabe992d6c740f18042b
SSDEEP

384:z1+aC64Zz0skzUmwCrzWIAmUBCiY6IH6zrVRnfwB9/VVNo0viBG:z1+3Z0snmwCWIAgiY6IHGrv4D/nNdvEG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e80933e096880fae168052f195981c2fd1d4243511d6a0c88f17088a1e1a0350.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e80933e096880fae168052f195981c2fd1d4243511d6a0c88f17088a1e1a0350.dll,#1
  2⤵
  PID:1196

memory/1196-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download