f9f47bf69dc61f09f3e49f1adf158f910e9e07ae05f5c69b6e82872a8937b57a

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 02:12

Target

f9f47bf69dc61f09f3e49f1adf158f910e9e07ae05f5c69b6e82872a8937b57a.dll
Size

6KB
MD5

49a31bbcedb0b49419dd14ea0c6311b0
SHA1

f94c79d158d542123827400e4fc9bfa6b650ee5f
SHA256

f9f47bf69dc61f09f3e49f1adf158f910e9e07ae05f5c69b6e82872a8937b57a
SHA512

8fbb9f97c4603909c32a2aed1ea1e2640967b608ee0d986ae6610f2fbb41cc489e722cece767433aae83d94b5b2f6b2a1bc477855d3aa55eceefba09545b792c
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgFkwgQjaOuYlMnU8QUoRThCUTsiwnm5pgFz1z:nI2RrUeqkLKMnUZCUTfDgfxpLqL91s+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27
PID 1388 wrote to memory of 856	1388	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f47bf69dc61f09f3e49f1adf158f910e9e07ae05f5c69b6e82872a8937b57a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f47bf69dc61f09f3e49f1adf158f910e9e07ae05f5c69b6e82872a8937b57a.dll,#1
  2⤵
  PID:856

memory/856-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download