0cc4eabec2d5bd5682c2bd374e1e0cc7b43acfa8bca18aad025e768cf5031d54

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:24

Target

0cc4eabec2d5bd5682c2bd374e1e0cc7b43acfa8bca18aad025e768cf5031d54.dll
Size

69KB
MD5

64d5bdae461baa95ea18024a6e6caa3d
SHA1

13d905a61de5ef5b037fd5a4092be997eb65f58e
SHA256

0cc4eabec2d5bd5682c2bd374e1e0cc7b43acfa8bca18aad025e768cf5031d54
SHA512

fe5ffda6f320772563a2fe48bdd249f709f76f9cb50967ee78307ef9952dec0ba21757a6b96cff7e395ef0e73208a35d12a994562fb719cbafc5d930ceff5cb2
SSDEEP

1536:9Mtc2YMa4sfzUF7+WY+2WI0fFp/Fyg8WMb8iXzTNauCSW:4KMa9oZ2WI0fFp/FylWEztauCSW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cc4eabec2d5bd5682c2bd374e1e0cc7b43acfa8bca18aad025e768cf5031d54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cc4eabec2d5bd5682c2bd374e1e0cc7b43acfa8bca18aad025e768cf5031d54.dll,#1
  2⤵
  PID:1692

memory/1692-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download