fbd639a127c6b69b401c8f1a9dfd533d2bf5c743f467914459eacc6f8a4c3e18

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 05:52

Target

fbd639a127c6b69b401c8f1a9dfd533d2bf5c743f467914459eacc6f8a4c3e18.dll
Size

19KB
MD5

11758a4907bedb60dbdcb2a6b35e851c
SHA1

b366d4d4d4d51ce26ecd4df6cd771696c3363d4b
SHA256

fbd639a127c6b69b401c8f1a9dfd533d2bf5c743f467914459eacc6f8a4c3e18
SHA512

3ea690b1014f13c19571facbba8c4801add8e9ba247326df2b1175d5f78d61a9a6e5cfb34c14e7258e438d3e71054d7448ebd7cf8196a39da318129dfc67c89b
SSDEEP

384:qonKi35+0kXADV9Ie3yUzSIMU8pBncd4:5v3I7I7acd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd639a127c6b69b401c8f1a9dfd533d2bf5c743f467914459eacc6f8a4c3e18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd639a127c6b69b401c8f1a9dfd533d2bf5c743f467914459eacc6f8a4c3e18.dll,#1
  2⤵
  PID:1528

memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download