f3f1921ad6856fb6bda3065849cea4bc4d73a9a1f78941dfe359886097a1ec79

Analysis

max time kernel
18s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 10:39

Target

f3f1921ad6856fb6bda3065849cea4bc4d73a9a1f78941dfe359886097a1ec79.dll
Size

6KB
MD5

6ca4130db0561054ec6391b1473f98ca
SHA1

811e96799ceee975b755dc210bce5c563201c7b0
SHA256

f3f1921ad6856fb6bda3065849cea4bc4d73a9a1f78941dfe359886097a1ec79
SHA512

281831dfdb02fb1261697699629c30adfe9031f67dadf71840adcef3f3ae4de369b99065d5ee86469cd00229f9426e70091f1b649e9487b589712edeabd2e2c9
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNiJr7yWdy5UsiSmUnH6:PyIIjWXGhqCr7n8UskUnH6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f1921ad6856fb6bda3065849cea4bc4d73a9a1f78941dfe359886097a1ec79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f1921ad6856fb6bda3065849cea4bc4d73a9a1f78941dfe359886097a1ec79.dll,#1
  2⤵
  PID:932

memory/932-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download