f4cae133b0ce8370cd9736c9968dfd16cdafeb4dc3e022ef08792d7644781bd7

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 02:24

Target

f4cae133b0ce8370cd9736c9968dfd16cdafeb4dc3e022ef08792d7644781bd7.dll
Size

7KB
MD5

ab25996f656bf12cb87f5224c69020cc
SHA1

4dca104043a3696a333e21dd1a302268fec36fce
SHA256

f4cae133b0ce8370cd9736c9968dfd16cdafeb4dc3e022ef08792d7644781bd7
SHA512

fbf32f02bc6e12629750db6e679009932baa0800bc339ce784973cba4943d363e9da2900a8930f7d6f5458f9d8e18183ecaca36c6dbc8d44e2b3ba325a2acb3c
SSDEEP

96:xspY4nwHuPN1rFCTCFuSXKlABTkxYw90lL6wMPyC3p9NdR4zk:YBCTXSXPT6+aq+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cae133b0ce8370cd9736c9968dfd16cdafeb4dc3e022ef08792d7644781bd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cae133b0ce8370cd9736c9968dfd16cdafeb4dc3e022ef08792d7644781bd7.dll,#1
  2⤵
  PID:304

memory/304-54-0x0000000000000000-mapping.dmp

Download
memory/304-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download