7fbd4579d21a64783f62875f6b8f426fdd39b394f1f358753d15129090dce3a1

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:02

Target

7fbd4579d21a64783f62875f6b8f426fdd39b394f1f358753d15129090dce3a1.dll
Size

24KB
MD5

6c45cc4f18a910e651dd4c075fe6ac86
SHA1

6dc5a9e0e4a7ed37cc718f3fcdac3e606a3c0c62
SHA256

7fbd4579d21a64783f62875f6b8f426fdd39b394f1f358753d15129090dce3a1
SHA512

2c3c92b406d08a34dc0307c183c22534edc4003f66fcb0fe1568c1766e9828ae9397014817e7694e80e2811d58855f3ccd1ce7f13339637b38f9b76a2177f8bf
SSDEEP

384:jgsisCC0u2xsXhUSwL7NIJdv1E0ZVAZ44kySiVSkr7MqqDpHk:arCbOtNINNDAZ4aSiVSk3OHk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28
PID 1364 wrote to memory of 1964	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fbd4579d21a64783f62875f6b8f426fdd39b394f1f358753d15129090dce3a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fbd4579d21a64783f62875f6b8f426fdd39b394f1f358753d15129090dce3a1.dll,#1
  2⤵
  PID:1964

memory/1964-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download