c1bd1b7224060dabccbb9962b78d0ffd4652dadc96916536a74be7bf496982c8

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:06

Target

c1bd1b7224060dabccbb9962b78d0ffd4652dadc96916536a74be7bf496982c8.dll
Size

18KB
MD5

96009323f25561fd3dfc1b715e6aca90
SHA1

48020e39288b2c64e0c2e232f366c13bd582ec2c
SHA256

c1bd1b7224060dabccbb9962b78d0ffd4652dadc96916536a74be7bf496982c8
SHA512

08d2fff265ea060ccbdab272e98ffc571d79fdf80ce5771aa43def680d0f8ac26802aa5dd1f332e866a4dd2541685d43de3d384ee01240e7b2bc35b73a24dcbf
SSDEEP

384:InXR3O0S4aHmk11w+z3uc99AB2QwBpJ5SZnHo0vij+p6:IXNO0eRTT3ucTABk7JUZHdv+o6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bd1b7224060dabccbb9962b78d0ffd4652dadc96916536a74be7bf496982c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bd1b7224060dabccbb9962b78d0ffd4652dadc96916536a74be7bf496982c8.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download