effa04f16794526e9777b57b1d6c400d45c819f9a34143cb16b65fd8d9675a82

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 03:35

Target

effa04f16794526e9777b57b1d6c400d45c819f9a34143cb16b65fd8d9675a82.dll
Size

5KB
MD5

688106d3f4f315716977df6ee0c70670
SHA1

be01ce97a6ee0649d5ca0ba9c59d9c7ff2b373c0
SHA256

effa04f16794526e9777b57b1d6c400d45c819f9a34143cb16b65fd8d9675a82
SHA512

3c68c92f6239226124f85f7936774bafaa89684fd507456baf8471b0ae8797b0b3bb5a7979c5ce64a0dfe06b86888a645fa21f3a8030659b06d15a840cb63499
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiGCZ:XUcA+ggd+W/If0iACZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\effa04f16794526e9777b57b1d6c400d45c819f9a34143cb16b65fd8d9675a82.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\effa04f16794526e9777b57b1d6c400d45c819f9a34143cb16b65fd8d9675a82.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download