906f564d2c16ad9e9f275a7bfd5d20c58d9dfcc79e8cf53f8361150ba5c1102d

Analysis

max time kernel
3s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 18:01

Target

906f564d2c16ad9e9f275a7bfd5d20c58d9dfcc79e8cf53f8361150ba5c1102d.dll
Size

33KB
MD5

157578efafdd6cb4306393b5021ec87c
SHA1

94ea8f1e68fab827095e0c67bb59ff056aab2980
SHA256

906f564d2c16ad9e9f275a7bfd5d20c58d9dfcc79e8cf53f8361150ba5c1102d
SHA512

c5f2aec9956225b21271e052028cba3ad2324c68cc9f6dfba7fe3b3d8828c27ead278459651d3a318c7aad13652ecd65697cccfa508879f5bd21b4e41c0ebfe2
SSDEEP

768:DbthYton1M/4wgYn+07AQuzphqDLRr1j8:Dbtko2gYr7AjVkHRr1Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\906f564d2c16ad9e9f275a7bfd5d20c58d9dfcc79e8cf53f8361150ba5c1102d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\906f564d2c16ad9e9f275a7bfd5d20c58d9dfcc79e8cf53f8361150ba5c1102d.dll,#1
  2⤵
  PID:1368

memory/1368-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download