4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 09:58

Target

4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll
Size

6KB
MD5

13515a91cfe209b0f5f7e549dc691ae0
SHA1

31d3cbf90f168633621617ef944918ed70601e1a
SHA256

4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f
SHA512

2cc3da5d68d962c0e544e0aa851816b9647d8dd59c658a334c58821b0035a4ab87bb166f4bac3b0229889ccedae88e7e2bafcaf34a58dd7758b18bb76d7a5001
SSDEEP

96:nI2RrUeqnnQ66lj//NuHIUJlKKQ84RmO:XR4eA0ljaITbRmO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27
PID 1976 wrote to memory of 1196	1976	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll,#1
  2⤵
  PID:1196

memory/1196-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download