6b9be00575a7b142812dcc52b20aa841d059d17be6699df66e770a27d5c3a11a

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 14:24

Target

6b9be00575a7b142812dcc52b20aa841d059d17be6699df66e770a27d5c3a11a.dll
Size

32KB
MD5

5321aba110fed6c266d8ef138ac45b25
SHA1

668396a87d19681bb8b5210cd5c2b850c500d978
SHA256

6b9be00575a7b142812dcc52b20aa841d059d17be6699df66e770a27d5c3a11a
SHA512

cdbe62ec099b3f622198a6ac3ca5ff4d465684ebcc8b6012491df408e3021f024103854995d277f7e54271c71a7f5328fa72b4379bd03811ae31bf1590eafdd2
SSDEEP

768:WqnOeTNYmNXW/t8/lo7tRypE5hqD5SROde:WqnOerUt8a7tRQakgROY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28
PID 1832 wrote to memory of 912	1832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9be00575a7b142812dcc52b20aa841d059d17be6699df66e770a27d5c3a11a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9be00575a7b142812dcc52b20aa841d059d17be6699df66e770a27d5c3a11a.dll,#1
  2⤵
  PID:912

memory/912-54-0x0000000000000000-mapping.dmp

Download
memory/912-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download