12ed18bc17fbb414e2933daa041a55612d9f19ad19375eac4ded0f60af45a879

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 22:51

Target

12ed18bc17fbb414e2933daa041a55612d9f19ad19375eac4ded0f60af45a879.dll
Size

19KB
MD5

6ac98fd51474f1ecac5251bb84f1cb30
SHA1

3016a21d6fb477599c1400803519afe0e62bc4c7
SHA256

12ed18bc17fbb414e2933daa041a55612d9f19ad19375eac4ded0f60af45a879
SHA512

84ce2754353b30c2783506d2c7f1baa88d504296b4fe7bb1b5d43a8941b269e82944cc62b36c858deae18cd69bb12cac2e062597dd9a715fafd935123d451e50
SSDEEP

384:gFCiLbX8CxjZ8+0XplAucMHuq6TlFhnrM:g3sC8pXPMMOq6zu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ed18bc17fbb414e2933daa041a55612d9f19ad19375eac4ded0f60af45a879.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ed18bc17fbb414e2933daa041a55612d9f19ad19375eac4ded0f60af45a879.dll,#1
  2⤵
  PID:1760

memory/1760-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download