fcffab3f1274ae3858f0ab881b4f99841d5911eb9d194fbd5ca82672af14e94d

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 20:42

Target

fcffab3f1274ae3858f0ab881b4f99841d5911eb9d194fbd5ca82672af14e94d.dll
Size

5KB
MD5

8297202b7428a42411dbc961ccaebd24
SHA1

ed6c7701e297ed5d4ea614baa0229ae7512d4172
SHA256

fcffab3f1274ae3858f0ab881b4f99841d5911eb9d194fbd5ca82672af14e94d
SHA512

1880fa6b58fd4df2486bdb8bad0b95db28c3d1c914f3e2720d15094da978f072e7379da2fe20f6936f55ef576aac29b1634e242b518bbca2e75360cbe42d9348
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKDn5VAk+psem86dg77WLRBFQvJiGtrhJiromon6TgKpV:PT3r2vu9O3Hn817WL30iGtniroPegSV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcffab3f1274ae3858f0ab881b4f99841d5911eb9d194fbd5ca82672af14e94d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcffab3f1274ae3858f0ab881b4f99841d5911eb9d194fbd5ca82672af14e94d.dll,#1
  2⤵
  PID:1996

memory/1996-54-0x0000000000000000-mapping.dmp

Download
memory/1996-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download