6f28c8c464cb2cdd792300e346a074a8300056ec734d4d03944d477237f718d4

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 21:05

Target

6f28c8c464cb2cdd792300e346a074a8300056ec734d4d03944d477237f718d4.dll
Size

256KB
MD5

0d1ed207e25226d9c1b6bcb637ba4ce0
SHA1

6794d277f3307553412bf5e8e5fd7b199430169b
SHA256

6f28c8c464cb2cdd792300e346a074a8300056ec734d4d03944d477237f718d4
SHA512

3ac46aa3fc370f43fd05588626cffe2d4122f24dabeeaa627964f5abfea080fe2aaa0c14142a76b45e095ecde10195df0521fc0ebc70ef8e07d989f4091e2eb8
SSDEEP

6144:usj3wFxht9IW23Xg3qgSMMHMMM6MMZMMMglMMMOMMeUMMTEBcDtCa7:usj3wIOfSMMHMMM6MMZMMMglMMMOMMea

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28
PID 1964 wrote to memory of 1340	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f28c8c464cb2cdd792300e346a074a8300056ec734d4d03944d477237f718d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f28c8c464cb2cdd792300e346a074a8300056ec734d4d03944d477237f718d4.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000074E00000-0x0000000074E45000-memory.dmp

Filesize
276KB

Download
memory/1340-57-0x0000000074DB0000-0x0000000074DF5000-memory.dmp

Filesize
276KB

Download
memory/1340-58-0x0000000074DB0000-0x0000000074DC3000-memory.dmp

Filesize
76KB

Download