d856679408def9429efbc0b3ab14c9c474896f6c423b09d2d04f41f3c0cb350b

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:07

Target

d856679408def9429efbc0b3ab14c9c474896f6c423b09d2d04f41f3c0cb350b.dll
Size

62KB
MD5

6729e0c0b9b57e2c5e081e9cc13009f0
SHA1

d2d4ebb8e2bfc1754c34e3b79701b0dcbf99d32a
SHA256

d856679408def9429efbc0b3ab14c9c474896f6c423b09d2d04f41f3c0cb350b
SHA512

2ad51af9c25c53dafccac28e779a54875ce018fc39308b813e0a31489b72bc26cf9094281d123d218fb618e6ab0ac042bfe6ea505cc0845a07568c128d73ae3f
SSDEEP

1536:soa1lMWi/PF1GH5d01EQjLDceSytjUVm3BgTt42pG:SMWiLaLCLD9n3itNG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d856679408def9429efbc0b3ab14c9c474896f6c423b09d2d04f41f3c0cb350b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d856679408def9429efbc0b3ab14c9c474896f6c423b09d2d04f41f3c0cb350b.dll,#1
  2⤵
  PID:1292

memory/1292-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download