7f293e9657c537792802e67dbafe746ad5e73bdfb5716338efd199b19f764c0d

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 03:49

Target

7f293e9657c537792802e67dbafe746ad5e73bdfb5716338efd199b19f764c0d.dll
Size

80KB
MD5

5869642662d0837c30a5b0bd203e70c4
SHA1

6caf8d653ae2ad6c92e9d2bc17d46d16b0073d7b
SHA256

7f293e9657c537792802e67dbafe746ad5e73bdfb5716338efd199b19f764c0d
SHA512

afbddbeed738fc19cdcac0cd57714249df6ff254c1ebe64831a9027f6f57b303337f164b3891db8e965bc89c5811b03feef267dbf226adbd831dc337de20a510
SSDEEP

1536:9agFXMs3AOB87inIrKg+eOKAnWUm/U0SBaRPSnbHvxMz+H:9agVMsHB8eIrKg+dKMWodB0+bPxyA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f293e9657c537792802e67dbafe746ad5e73bdfb5716338efd199b19f764c0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f293e9657c537792802e67dbafe746ad5e73bdfb5716338efd199b19f764c0d.dll,#1
  2⤵
  PID:1472

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download