a6a6cda76abf5221b37a5bae37d90f7c7d0fe0ea135a534222193c683b457643

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 15:01

Target

a6a6cda76abf5221b37a5bae37d90f7c7d0fe0ea135a534222193c683b457643.dll
Size

16KB
MD5

913699510344842483e2bb77bdba0cd6
SHA1

142ca18c3665e4c4e721bbfd6985ebd294319c3a
SHA256

a6a6cda76abf5221b37a5bae37d90f7c7d0fe0ea135a534222193c683b457643
SHA512

49805a7df96322d17e08fffc4546e3bac05914007373d441216881f8d724494fec3b5f4501d343c0f274dad8d2b2857f65be20ad17b36ad9c6161780f2fc5c43
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKEx:JT0qmznB6rwUmRvRz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27
PID 1128 wrote to memory of 900	1128	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a6cda76abf5221b37a5bae37d90f7c7d0fe0ea135a534222193c683b457643.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a6cda76abf5221b37a5bae37d90f7c7d0fe0ea135a534222193c683b457643.dll,#1
  2⤵
  PID:900

memory/900-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download