68ed4bb4b546ff5855376b24f47e77344afc28028aec562953373656b30c504c

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:49

Target

68ed4bb4b546ff5855376b24f47e77344afc28028aec562953373656b30c504c.dll
Size

6KB
MD5

3cd7c5fff5ad03d0f4f4b1e25b0fd2f0
SHA1

9cb818244f842f91e0a2f1bca0dadbc0c50d1bd9
SHA256

68ed4bb4b546ff5855376b24f47e77344afc28028aec562953373656b30c504c
SHA512

5c7dde87a0b5a51ee46e05c9a3923fc63c3a46f3cead462f3e55dee5ef02a7880a333df22dfd3126b4f21bd7912d0a50f0b774d77fa84ca841cb754ceec914c7
SSDEEP

96:WLRxkjujtjd8jPjcZG2Uo5B1GPMH5Y4AxW7fbD:WtqKR6bgYI5nGPag

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ed4bb4b546ff5855376b24f47e77344afc28028aec562953373656b30c504c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ed4bb4b546ff5855376b24f47e77344afc28028aec562953373656b30c504c.dll,#1
  2⤵
  PID:1672

memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download