8f2f0150f1b4b6a4950cad07a0bdfdb1bd9c769f396c9dd6d9565d6a9f2a943d

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:44

Target

8f2f0150f1b4b6a4950cad07a0bdfdb1bd9c769f396c9dd6d9565d6a9f2a943d.dll
Size

52KB
MD5

66b1206f4c4d2d76ff9ebcefb03ee1a0
SHA1

efa2afdbf9e9f8c6718d8f5eb92bb1996176ccb3
SHA256

8f2f0150f1b4b6a4950cad07a0bdfdb1bd9c769f396c9dd6d9565d6a9f2a943d
SHA512

18a7c17ae6634eb20f5b826650a348c0241d8e072d7710aff717d0de06e49815f0d2b92e6317de5100a293951ddcfb09a68fba98913491e8b12a007c40229dfc
SSDEEP

1536:evAiA+sT1WlWpkIdFOByiv+DV0zNQQwrFGhU:ZBWlyrdouWxvSGhU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f2f0150f1b4b6a4950cad07a0bdfdb1bd9c769f396c9dd6d9565d6a9f2a943d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f2f0150f1b4b6a4950cad07a0bdfdb1bd9c769f396c9dd6d9565d6a9f2a943d.dll,#1
  2⤵
  PID:1928

memory/1928-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download