9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:59

Target

9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll
Size

13KB
MD5

8281dc842317a473f93ca40918796837
SHA1

45b62c5ba6f7ee37c94da1f460def55e3bfb7395
SHA256

9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e
SHA512

f1ab6bfac345d947f6c617f8259910312758522f93c718d41a5c3996f9d4aafdecbbede8dd4eb6941d0215ced58236dcf89120a11924c996ceee9f34b6214070
SSDEEP

192:RRzVPeuZA9JvY6r7r0t+lgoVRferWPcG0oaBMTVDJYuxZ/:TzV2uZA9Tr35RfLPcBxBMTVD6ux

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll,#1
  2⤵
  PID:1704

memory/1704-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download