6c6d8b42361d4fc50a534c108d759291e9ed3fd446e7a6471e53c637284e0a8c

Analysis

max time kernel
142s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 12:30

Target

6c6d8b42361d4fc50a534c108d759291e9ed3fd446e7a6471e53c637284e0a8c.dll
Size

15KB
MD5

07af5f9512ba476bd23b9aa2b15317e0
SHA1

e2ca2060b37e047e306426f0c6e55613756d0bfe
SHA256

6c6d8b42361d4fc50a534c108d759291e9ed3fd446e7a6471e53c637284e0a8c
SHA512

78e2242e427854c89b11512f700257a3b943d4c5cd9f0e09edc23d9960858345a4d0ad928285b9b1f771c16c4e5f3cb896559800f8841c26cd16d81c28c7b7c1
SSDEEP

384:AvOzpUzOzfCzOmjfGTqTeTqTfGTqTeTqTfGTqTeqUYKWTSZmCfMmNgWMSoJevXrL:B67HHvU3ZmaMcosf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c6d8b42361d4fc50a534c108d759291e9ed3fd446e7a6471e53c637284e0a8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c6d8b42361d4fc50a534c108d759291e9ed3fd446e7a6471e53c637284e0a8c.dll,#1
  2⤵
  PID:988

memory/988-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/988-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/988-57-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download