31ab7cbf0c3540155b9cbd91a5d062a4fc9169bbfc4d0f292e09d84a37ff093c

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 08:48

Target

31ab7cbf0c3540155b9cbd91a5d062a4fc9169bbfc4d0f292e09d84a37ff093c.dll
Size

91KB
MD5

6889e815a9267830d90364b4eb8e5c26
SHA1

b6091799f8a516fe910fbba0726f34f20867991a
SHA256

31ab7cbf0c3540155b9cbd91a5d062a4fc9169bbfc4d0f292e09d84a37ff093c
SHA512

df7d304f2f00d19ca5039d8d9d266f176e82a0eb4ae0e5c8079b6751a4e05907b411625b12ffcfdbbd6471c318e6de436233bf43718829a82c04d490aaea00dc
SSDEEP

1536:Zn4Mi33LS7enDxBxBkQhWNQgVVxceFZEcI0aUDY9XR:Zfi3b8enD3xBT0agUYEcIZMY9h

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ab7cbf0c3540155b9cbd91a5d062a4fc9169bbfc4d0f292e09d84a37ff093c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ab7cbf0c3540155b9cbd91a5d062a4fc9169bbfc4d0f292e09d84a37ff093c.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download