ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 17:26

Target

ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll
Size

19KB
MD5

12a7e662ebd1b63d172db9232ba67cb0
SHA1

faab9e3171614bbf0eafcf53b99bd62ad32cfdf0
SHA256

ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b
SHA512

0acf73107caceaa7cca85df4809bdcfac31caafb99032270d94b7d8880f3600bd65ad97f93134eea3a0db877100c5ec4800a4ecfe34923d103903c412b722a06
SSDEEP

384:f7/n22ITPgfEhDsrQ800i80zY4+j7JdZgU0FaXE8:f7/nyPhhDsGn80zpW7JdZgtFaXE

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1272	rundll32.exe
3	1272	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1272

memory/1272-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download