859bc0e9165414bbbafdd23a1a6ec6b92c9232479569d1194f28776a27f3e63a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:39

Target

859bc0e9165414bbbafdd23a1a6ec6b92c9232479569d1194f28776a27f3e63a.dll
Size

62KB
MD5

645414946a68155e3233cfebbca9e619
SHA1

0aa32c2e8aab7724f35811391d9fdb22bcc8d9c2
SHA256

859bc0e9165414bbbafdd23a1a6ec6b92c9232479569d1194f28776a27f3e63a
SHA512

fe3542ccbf75782d43aca51ff71d923d69bf927d1f3a4c07143f4ee75f1116b9cc547f4989ee139fb3beebc8781fbf2ef78e4bd88b959441f56c82a7048d79e3
SSDEEP

1536:mPO6KEVbsVP0gO7REIhkB8Bvvf2Pp1UC14bT0AOJ0Tdrh1:cMEVbsVcXGkkB8xLf0Addl1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\859bc0e9165414bbbafdd23a1a6ec6b92c9232479569d1194f28776a27f3e63a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\859bc0e9165414bbbafdd23a1a6ec6b92c9232479569d1194f28776a27f3e63a.dll,#1
  2⤵
  PID:1460

memory/1460-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download