f8092213806956aaeb8da88e93b0eb2083db6ff12465c5c5a15bee2a383d86b2

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 15:47

Target

f8092213806956aaeb8da88e93b0eb2083db6ff12465c5c5a15bee2a383d86b2.dll
Size

6KB
MD5

733313299f4c2c4a42eeff6dd039be11
SHA1

22622aacd423163ccaee7a76fe1ad3ee8a1f3bd7
SHA256

f8092213806956aaeb8da88e93b0eb2083db6ff12465c5c5a15bee2a383d86b2
SHA512

3189afe75970730f312a6ba9030215a7a2e47965ab25336d7b4a094135aedb0ac11725e72644b3793e76d0290ec8ee585c5120569c7b6bcc959d76802b2bd95a
SSDEEP

96:nI2RrUeq9hfDr51njQbDobKJtpyFvflgpNxEUMlNOh:XR4eaZQSp0qx/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8092213806956aaeb8da88e93b0eb2083db6ff12465c5c5a15bee2a383d86b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8092213806956aaeb8da88e93b0eb2083db6ff12465c5c5a15bee2a383d86b2.dll,#1
  2⤵
  PID:1124

memory/1124-54-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download