ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 05:53

Target

ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll
Size

335KB
MD5

93825f1151274a2f6f2758574affb6c9
SHA1

3b9b02f09690d13ea8bf77e921b7d6784957a56e
SHA256

ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4
SHA512

9ed333b61b604d0cfd002bd2c422b22c8890b81fdd4230393ce75da35ba144dba531d48d48409674f48b74ffd5388744b44a80fbbf5eee1d09222838342a590c
SSDEEP

6144:b2RCAOQI+7dfKzhBg3BU9MESibsQkzCEPFMniF+NrbsYgWeXL:ACG17dfergK9MESioLmEcq0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27
PID 1504 wrote to memory of 1628	1504	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll,#1
  2⤵
  PID:1628

memory/1628-54-0x0000000000000000-mapping.dmp

Download
memory/1628-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x00000000001E0000-0x0000000000238000-memory.dmp

Filesize
352KB

Download