ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:52

Target

ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd.dll
Size

1.2MB
MD5

fc4d18d087f949e4e87ab48fed71caee
SHA1

c416ec846548db8eb177c2a3b053061519bbead0
SHA256

ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd
SHA512

48fb6baf18ee77079c6ed17d204c6e98a47b8e09674be1bf67cffb0bb8cc50fc2060b3ab2c6a575cc7c7a4bcee32fff1ad88520135ae4902bfacacbbd7fcb7ab
SSDEEP

24576:iuZU+XGvYdgqsKp6pl+imXwA4IClMgP0Qb6r+wzpdLTIa/ElhXgipjorI+5cwE:GjqHp6pl+rwA4x4pdAhXXpjofKN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd.dll,#1
  2⤵
  PID:2016

memory/2016-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download