f6da055e193fb87a5ae6744153fbca535f90c9f099fed289cc8d5b221d9ec493

Analysis

max time kernel
3s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 20:42

Target

f6da055e193fb87a5ae6744153fbca535f90c9f099fed289cc8d5b221d9ec493.dll
Size

5KB
MD5

9148801013c563bf851cf9dda3c313e8
SHA1

2a9a6ce407128b6b4e5ff8a1de2c693dfa99b631
SHA256

f6da055e193fb87a5ae6744153fbca535f90c9f099fed289cc8d5b221d9ec493
SHA512

449426fcc4bb03b2c5596aee6d8c925e1b20aec52056b20b760ff2b503b358ea0273664360875585fd462e4c7d4cc94654b0334fe6d41098b1bc087f7ef6258a
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIwVV6WAA9pAAA:unSR6bgYzf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6da055e193fb87a5ae6744153fbca535f90c9f099fed289cc8d5b221d9ec493.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6da055e193fb87a5ae6744153fbca535f90c9f099fed289cc8d5b221d9ec493.dll,#1
  2⤵
  PID:1620

memory/1620-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download