609464af489b0692d6c9ad737ac2b5604daff81649e6cebfbcecaa3866f04376

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 15:46

Target

609464af489b0692d6c9ad737ac2b5604daff81649e6cebfbcecaa3866f04376.dll
Size

6KB
MD5

6ee8888deedfec558866848e614d0023
SHA1

315523dbd58b848bcce8f05196484cbd08b59868
SHA256

609464af489b0692d6c9ad737ac2b5604daff81649e6cebfbcecaa3866f04376
SHA512

5d110d862490c5036c57b12b34cadeb508698678c90d480c2f718517eaefd136a2cf5322199f70e20bd862dcda35718ee29f1fa3c2dfe7639f089017da3c24a4
SSDEEP

96:nEY2RrF1eqwi4YLmk+XYmo7Csr/w72+cHkY/H5J:EHRh1eppYqaxuMYqrHky5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\609464af489b0692d6c9ad737ac2b5604daff81649e6cebfbcecaa3866f04376.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\609464af489b0692d6c9ad737ac2b5604daff81649e6cebfbcecaa3866f04376.dll,#1
  2⤵
  PID:916

memory/916-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download