ee0f78bb77d4a3af5a0b751330c8049210a1e3ffb5d57ff0dc7e6cc8e90d12fc

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 02:30

Target

ee0f78bb77d4a3af5a0b751330c8049210a1e3ffb5d57ff0dc7e6cc8e90d12fc.dll
Size

28KB
MD5

56a4b3188c844922ace62d94d7a03780
SHA1

8e544845e4d6df5c1d0d550fdaafa9bdd1d8afd9
SHA256

ee0f78bb77d4a3af5a0b751330c8049210a1e3ffb5d57ff0dc7e6cc8e90d12fc
SHA512

ba22109c000b83bec0db40f1ef38cf8e3e578db3fa3a7de9c2b0343a4d573c70a77c35b31ddb50da6a9822e7b02ee8ae03e703554b25b9ade2b46fed2dff5268
SSDEEP

96:wT1+l2n11FhplC7N7lM1yxDshOB9ErQAQY:BDs/rQAQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee0f78bb77d4a3af5a0b751330c8049210a1e3ffb5d57ff0dc7e6cc8e90d12fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee0f78bb77d4a3af5a0b751330c8049210a1e3ffb5d57ff0dc7e6cc8e90d12fc.dll,#1
  2⤵
  PID:1080

memory/1080-54-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download