eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 14:39

Target

eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll
Size

20KB
MD5

6ec375367a8db8be4c5c5154c805d7a8
SHA1

a1530304f8980909d66bd2f2dc1a0c5af6e17b4d
SHA256

eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66
SHA512

bd9b9dd3ebb5c7bcb18c22ac411310547ce7e494060583a334524e5057c9164ea94b41969ce74356e9990bf1f82c551f9b522a65bf03235e938d2e4a10c2902d
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XpldCAu8UaWHuqaTlX0wG:zfYh2oCtpXPdx2OqaewG

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1536	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download