6146b8e1d05d7549dba91842ff2a84627087cd856038a9442b5c58fa4ebff0cc

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 21:01

Target

6146b8e1d05d7549dba91842ff2a84627087cd856038a9442b5c58fa4ebff0cc.dll
Size

28KB
MD5

01a98d96fb10d5f8b0bde980960ca420
SHA1

946dad6352879fc8628916105865d7f5d463b947
SHA256

6146b8e1d05d7549dba91842ff2a84627087cd856038a9442b5c58fa4ebff0cc
SHA512

fee3abd873a24956ed8bc6a3343efb250cea28bdda6ee6827275899e74a56a4ea72d98b97f530b27625cc05bf9572b38ee7334c9348ea7aab3c9860fb2f6e38f
SSDEEP

48:iWp6vl4f1191FlkXNPdlS1zQAtb35UH54Q9EeyPxgSn:q1TAtrOB9EryS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28
PID 1896 wrote to memory of 2012	1896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6146b8e1d05d7549dba91842ff2a84627087cd856038a9442b5c58fa4ebff0cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6146b8e1d05d7549dba91842ff2a84627087cd856038a9442b5c58fa4ebff0cc.dll,#1
  2⤵
  PID:2012

memory/2012-54-0x0000000000000000-mapping.dmp

Download
memory/2012-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download