ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:47

Target

ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll
Size

4KB
MD5

3aee63902559602a170d1056dc7b1386
SHA1

61d18bbbc51ca97c1a4091d40245872a99d2fbee
SHA256

ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25
SHA512

2f22cb805566dc28f57f512c23af6f55db61f1478c87022a73a3414d83d148c2ce0e7044bea1e0dfe55c635206923270e3fe0a68f3db4f689a3ab8dc46cf1a0f
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKCg8iXgSvlmkpcv7hXoMlBo1pzuFKu2Af:PT3r2vu9G8mdhczZ/sxe5df

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27
PID 900 wrote to memory of 1756	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll,#1
  2⤵
  PID:1756

memory/1756-54-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download