a1f06a6dba6fd01146a425a490581ea2efe0d5ed145b684a787c8d4ac20cf640

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 19:49

Target

a1f06a6dba6fd01146a425a490581ea2efe0d5ed145b684a787c8d4ac20cf640.dll
Size

206KB
MD5

72b2daf5f59015a1b843605b44a54285
SHA1

2a4c8886d6e682816df69e3c1151951dae38b68c
SHA256

a1f06a6dba6fd01146a425a490581ea2efe0d5ed145b684a787c8d4ac20cf640
SHA512

47c22d1639e8116ae9a6a6d6e264fa8c393fd3a1c6954493eca6c5afccfee64d534f15673c6f6370da2de24049b176e1bdb3e78c370a3f642a3f3a515a291d00
SSDEEP

3072:BK/yxvfGR1iB9P59oINnrq0KE8NU2R1FDP3yMl+UDSADlsOpT7:BK/Qfqu1foINrS1FHsUDpCu7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1f06a6dba6fd01146a425a490581ea2efe0d5ed145b684a787c8d4ac20cf640.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1f06a6dba6fd01146a425a490581ea2efe0d5ed145b684a787c8d4ac20cf640.dll,#1
  2⤵
  PID:1928

memory/1928-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download