1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:52

Target

1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll
Size

86KB
MD5

a1b34174f23a34cf566ce04af21c41d8
SHA1

fd13b6a459fc9a0cc20b2325bda1dc6c1f9aa3d7
SHA256

1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1
SHA512

f16230c7916992069eed8485a941260e665af17bcc3dc6364b47d795a9d61fad085de6dd6e6713976da3ba8b6368d3e165fcba09463b703054b957adbc83f1cc
SSDEEP

1536:LXG9fNocyBzUWTb1YZ/k7RFAQiKkjTgQC4GArDl84VnV7HEhV5RYt6rN:AK3zU8s/k7NiviL0DlJVjao+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download