eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 20:03

Target

eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll
Size

404KB
MD5

0c4f6782ace747a39239568fac0fa1c0
SHA1

26b9548a1ae26cc71cd75a3bf099e05e96e077a1
SHA256

eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7
SHA512

d90bd98685f861a360811ce744cab1d031b2380c8d72f11fd66ee13d18d9d1da4e50a350fd7c7052bf1e612c9402428b780bea8a270094806753a3878be3d5eb
SSDEEP

3072:ZRyIqI7Zz2HkKbbve1fAlVTholfPSuQoh5i2jzfXvJUdIqmHO24hw/J6sFZT5Sl:eIqoR2EybYfc2jLXvY0Oxwh65l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download
memory/1172-57-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download