9074dde6d02dea1b33dd7bfa7feb575036772ae3da7fae72797c2464db594e80

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:52

Target

9074dde6d02dea1b33dd7bfa7feb575036772ae3da7fae72797c2464db594e80.dll
Size

54KB
MD5

08e3e92d1df5acc71f686cbedb3efd20
SHA1

547b6cc55cc1c4fea7e430bad9efc229fd9ecfd1
SHA256

9074dde6d02dea1b33dd7bfa7feb575036772ae3da7fae72797c2464db594e80
SHA512

aef3177f93e975f7e1adfc91b0a58a5a576a654d141365fde2615f4d8bd8c7e5a7cb8f098c06d0ad7c8435811a1404a0c0472d81777063172a83e200956a50bd
SSDEEP

768:AyTzuESadyohFfJTZB733GVeWZXzKUsbN2p457WDVW/kbcXkzKnYMCmBdt3G027s:gEGoZ6Ch9WVOkzLMt9PK/eFKqi5Qb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9074dde6d02dea1b33dd7bfa7feb575036772ae3da7fae72797c2464db594e80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9074dde6d02dea1b33dd7bfa7feb575036772ae3da7fae72797c2464db594e80.dll,#1
  2⤵
  PID:1480

memory/1480-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download