752cfdcdd2abaff01e4248970dab1cfaadd939eb58d873e1f059337048414000

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/10/2022, 10:58

Target

samples/eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll
Size

226KB
MD5

2104fae9f482a72002204d74c1ca1e1f
SHA1

8941d889cb199a234d99c90ce78a96411b6dedb6
SHA256

eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9
SHA512

7bbea688d851a36951bfaad77c1832f66671fc79691bd4ac63ee50725c5f7fd3b5a441dee18b6e62586f4f2d0f0b7d3f2ee74120295bf083af899150dd3d8116
SSDEEP

6144:rWwweAGxK1y5Eoz4wrETDftDB3U0hWB9y/3G:rWlSzxrEvfFdU0YBK3G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\samples\eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\samples\eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download