efb15d09444dced8eb7bccda739a350fe66a16312916ffd767ea2f2147665e2e

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 11:15

Target

efb15d09444dced8eb7bccda739a350fe66a16312916ffd767ea2f2147665e2e.dll
Size

75KB
MD5

5cb364590d1d9ef3d64a919a64aa3cf0
SHA1

d81ad810041bab58ed26707938bb3813d1391afe
SHA256

efb15d09444dced8eb7bccda739a350fe66a16312916ffd767ea2f2147665e2e
SHA512

cf53126eb5eea217e7506ca6b0a58050edfd62bde6e01df4094c9eed50c5361acbf2a610ec82c14e50a70d61ac1fef50ed0c42ad6a1fff6b8c7cc08b28127b63
SSDEEP

1536:2NpVwUMArxRpVxHnw6N2VN2jWTNyUaAYN9KgZPNRZqYtCtPR2oN6:0wZArxVxHnwU2/cYNykQJZCtPR2oN6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efb15d09444dced8eb7bccda739a350fe66a16312916ffd767ea2f2147665e2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efb15d09444dced8eb7bccda739a350fe66a16312916ffd767ea2f2147665e2e.dll,#1
  2⤵
  PID:1472

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download