9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af

Analysis

max time kernel
2s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 19:49

Target

9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll
Size

240KB
MD5

a06b8c9963488a5564072425f3c83d65
SHA1

4275a6e9876a1ee9a4d19fdaf19a818bdac6b691
SHA256

9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af
SHA512

97c3fab1838804387824b04e0a3acde0649cdd8c06e33ecefa2f39985ce4c60a610d223a2dc60242ea51e16b6d3df62688d38aef5f94eaaa5fead6c7f876658d
SSDEEP

6144:Xl1c2mN94/QzVrOi9Ql1c2mN94/QzVrOi9h:Xl1c2mY/Isrl1c2mY/Is6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download