961d5ab0f12594dcfa0e714b45c6be4580b919a5c1786529358b00d646ab7a61

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 20:44

Target

961d5ab0f12594dcfa0e714b45c6be4580b919a5c1786529358b00d646ab7a61.dll
Size

6KB
MD5

922be57ff0159398020f6c6fce9011a1
SHA1

da955e784ba7115812241167bc11d8ff93620876
SHA256

961d5ab0f12594dcfa0e714b45c6be4580b919a5c1786529358b00d646ab7a61
SHA512

a3ef323be5fb54cb4c57b749bbcb32b7b8c20b49e19657a6697cf914f80eb80f1075833d6fc8c5025de4360d7e3abe961d3e3ae0c29a2fbf58c136c45d354d85
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRObdXgXmSYD57pg:YXo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961d5ab0f12594dcfa0e714b45c6be4580b919a5c1786529358b00d646ab7a61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961d5ab0f12594dcfa0e714b45c6be4580b919a5c1786529358b00d646ab7a61.dll,#1
  2⤵
  PID:532

memory/532-55-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download