6fc8ea2d7bbfa78a11ea1438e62eb8cf6446e36ee6c656cafd1d367b0fa72862

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 23:35

Target

6fc8ea2d7bbfa78a11ea1438e62eb8cf6446e36ee6c656cafd1d367b0fa72862.dll
Size

96KB
MD5

efe728460c8ea3ba9614068899e74d96
SHA1

ada41a7afecd283d974b4f7a93866ea41e45633c
SHA256

6fc8ea2d7bbfa78a11ea1438e62eb8cf6446e36ee6c656cafd1d367b0fa72862
SHA512

dd962ed876f2e2b46f98fc4504a9ebcada549f004459138757595f62d09c9c788845bb94ca956abf7a281a74a3e56dd6c89b1ed5665f00607432e9ac9e4f218c
SSDEEP

1536:oWgXkghUGY+9bpC0RBhoTCGvQgE4LeUVoQMlIrsP:eckBiTCqEmeUVohIrs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fc8ea2d7bbfa78a11ea1438e62eb8cf6446e36ee6c656cafd1d367b0fa72862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fc8ea2d7bbfa78a11ea1438e62eb8cf6446e36ee6c656cafd1d367b0fa72862.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download