ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 03:38

Target

ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll
Size

160KB
MD5

0d6e134521144118c67a28da1d376ce2
SHA1

cfa4edeeffd33bf336e9446d7b143f6f002b79d1
SHA256

ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854
SHA512

f297f0176bd75c356f5e7cf6e86c750bc753c826951a9e17288629bdd89a909ca29e7a2bc04523b1b02248621f766467db9012f83066fda323e8e049e07921ba
SSDEEP

3072:VIU0JI9xgLIQL90dt3yjaRMSzMtQHuEpsGNYX30Sqfai6/glvnrLEHdMhUSWB:VIUx9OLIQLydtCeRMotH7prc0gOvyMh0

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1060 wrote to memory of 1028	1060	rundll32.exe	16
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:944

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

memory/1028-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1028-57-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1028-56-0x00000000001B0000-0x00000000001E3000-memory.dmp

Filesize
204KB

Download
memory/1028-59-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download