ecd74a978ff09214d09fb91aa8c04b762afe832307b76ed101543248d2715e62

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 11:53

Target

ecd74a978ff09214d09fb91aa8c04b762afe832307b76ed101543248d2715e62.dll
Size

57KB
MD5

46ff70617a4763e353e530f9c61e9ce6
SHA1

78c3092cc84828542fdd0b3eef1874d0d9fdd047
SHA256

ecd74a978ff09214d09fb91aa8c04b762afe832307b76ed101543248d2715e62
SHA512

c91eb4881c1e47e4fddcd0928727d3232684586af50ab9368746bdadc29700f9832a0e039dbb0b55a7d6ff5d3f213cac5f53c7cf6d0574ef20b6871cf1683eb7
SSDEEP

1536:MNIKDp4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:hqp4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26
PID 856 wrote to memory of 1052	856	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd74a978ff09214d09fb91aa8c04b762afe832307b76ed101543248d2715e62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd74a978ff09214d09fb91aa8c04b762afe832307b76ed101543248d2715e62.dll,#1
  2⤵
  PID:1052

memory/1052-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download