035605f6c07c59a3666bfa3ddca18615747312a41986e4ba80a103059fc33c0c

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:50

Target

035605f6c07c59a3666bfa3ddca18615747312a41986e4ba80a103059fc33c0c.dll
Size

6KB
MD5

6144d664d7c94383b893812dd30fa0e4
SHA1

617916a60049e979f092d7fe172162e4ce5a2dfa
SHA256

035605f6c07c59a3666bfa3ddca18615747312a41986e4ba80a103059fc33c0c
SHA512

1df33aacd39727fa429c7b4313b4f24cf2cd93af25aa87f27c4f81d2463ef8c21466ee58f68744393866a4b0fb23e09a21a167255069e12dd906a53cb78e737e
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4GjdM8385NotKrH8tw93m7ZRQ:2M/SdjbgYnhFkowctw9GY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27
PID 1220 wrote to memory of 1284	1220	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\035605f6c07c59a3666bfa3ddca18615747312a41986e4ba80a103059fc33c0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\035605f6c07c59a3666bfa3ddca18615747312a41986e4ba80a103059fc33c0c.dll,#1
  2⤵
  PID:1284

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download