c9f358b5fc90aa5520f8f64c93758e4bf38570483d1095197afe0f6f44d94df6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 22:55

Target

c9f358b5fc90aa5520f8f64c93758e4bf38570483d1095197afe0f6f44d94df6.dll
Size

55KB
MD5

006c6ea54bd2d4af9e2571e20c564cd9
SHA1

66461fb91167edce4c61fdbcaf58c63a12100f0f
SHA256

c9f358b5fc90aa5520f8f64c93758e4bf38570483d1095197afe0f6f44d94df6
SHA512

f5c3c1026de4f7fadbd02b6c4650a223f3ab49e58c18794ac4f619f8dc53362b4fcfe7d2ac93505df6b23fab1f15c6fc42b6e99352a9d6c4316e9c483e632b85
SSDEEP

384:MDqFfu80yhTSFemHlWuh9xBdzZdO/hAO9jJsjDEtb/aLJ:M2FfGMTSFemFhhHznOCwjwDElyt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15
PID 832 wrote to memory of 1640	832	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f358b5fc90aa5520f8f64c93758e4bf38570483d1095197afe0f6f44d94df6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f358b5fc90aa5520f8f64c93758e4bf38570483d1095197afe0f6f44d94df6.dll,#1
  2⤵
  PID:1640

memory/1640-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1640-58-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1640-57-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1640-56-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download