6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 20:04

Target

6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll
Size

212KB
MD5

8f7c533e0d5c0dd8f8145fbcf8f8dd97
SHA1

cdf0325b0bfd454cae591907c62e815aeeb60500
SHA256

6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325
SHA512

7f46454cbb4ee1778a74a42b082827da65a9c26fe9e7148d1a29fee870daa209bec6070de2221e6196519e2343104633b1ddbb08399aa526deb638880f88d9f4
SSDEEP

3072:geabaFQGzCrkYBpM3PcTVBwZB8z3n3G+jcmNrW65uxIoPNH37x7OOL9:9abaFQUFYEETVBkAX3G7J7xaOh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27
PID 852 wrote to memory of 1760	852	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll,#1
  2⤵
  PID:1760

memory/1760-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download