e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25

Analysis

max time kernel
44s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 07:24

Target

e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll
Size

9KB
MD5

45c81e829685d8056dabf336dae59ffe
SHA1

9946ea6277b47fdbe4fff7764b931703916bfc55
SHA256

e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25
SHA512

42a272b2506bf0b785ab9cdba4f1eb7b93aca0dbd6409fe48c90b3ab196e78c5c3d7b81f40dd3e37e31ee7f7406f86a7943c2273f715fdac2d9e8efbd55d50aa
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bE:wuwEt8rsTUtPLzKNWSYWF4bE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll,#1
  2⤵
  PID:1276

memory/1276-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1276-56-0x00000000001A1000-0x00000000001A3000-memory.dmp

Filesize
8KB

Download