66f8a414c174a053dc8a02f3f61521d14a921a9d36dadf2b49fe062e670b1544

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 02:26

Target

66f8a414c174a053dc8a02f3f61521d14a921a9d36dadf2b49fe062e670b1544.dll
Size

6KB
MD5

7159fc1f66bca6e749921af36685f0fe
SHA1

31e377d5fec357a403cff6e26def6d38d826e6a3
SHA256

66f8a414c174a053dc8a02f3f61521d14a921a9d36dadf2b49fe062e670b1544
SHA512

6e42b9b137acd8a217cb2cf4327d9c7921e399ad0a56a1d01c7add349921bda2e0111844fac27bbe9dc8c8b3308fca4b22153501f856ed14512d083635cfed9b
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26
PID 1544 wrote to memory of 1584	1544	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66f8a414c174a053dc8a02f3f61521d14a921a9d36dadf2b49fe062e670b1544.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66f8a414c174a053dc8a02f3f61521d14a921a9d36dadf2b49fe062e670b1544.dll,#1
  2⤵
  PID:1584

memory/1584-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download