9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938

Analysis

max time kernel
27s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:37

Target

9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll
Size

65KB
MD5

6b2bd82bca12c3a61a7a1a991891d100
SHA1

4faee0d1fbcd4d6fec21d8433ac6a47668641820
SHA256

9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938
SHA512

d420e286b4a4ed0b37e2e13484fcefad731406bba21fbcdaae8642019d0805e5177fde6bb555d4a291a5a2a56b9c4fe0f98c0cf2091ad0ad805458d0659990ab
SSDEEP

768:4sQBTinxkpd9phmfB20RTviDxS2GBg9fMcuqmyI+UWxJha5:45BTScd9zNDADBgnuqmL5m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27
PID 1136 wrote to memory of 1828	1136	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#1
  2⤵
  PID:1828

memory/1828-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download