f9bec34cefa84721dec19b13b39ba8df00af0bfb1dc83f0fcf0068edc055d9c7

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 23:56

Target

f9bec34cefa84721dec19b13b39ba8df00af0bfb1dc83f0fcf0068edc055d9c7.dll
Size

328KB
MD5

6e5890445e703c894a30404be66d40f7
SHA1

1aa85042d9bc93efd343bbe6a47a4bc4946502cc
SHA256

f9bec34cefa84721dec19b13b39ba8df00af0bfb1dc83f0fcf0068edc055d9c7
SHA512

b2f1231b6c0be98af8445c762154fd6fb1d7f592f6d0b05b0b40eacf09bb2777806f068679f4ea379ffce91db844811956accc74e3bd1c0c3065d820862caea2
SSDEEP

6144:H49U8UMaVL9ULtadLeL0racAC/cdvOoXA5PHA:59UgdEKAOyvOoSPHA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9bec34cefa84721dec19b13b39ba8df00af0bfb1dc83f0fcf0068edc055d9c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9bec34cefa84721dec19b13b39ba8df00af0bfb1dc83f0fcf0068edc055d9c7.dll,#1
  2⤵
  PID:940

memory/940-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download