06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 14:26

Target

06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll
Size

336KB
MD5

0524e24099f35adaba74258ec1de60ce
SHA1

b6f43afed6560340a8fdfa189b7bb81cf55387f8
SHA256

06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431
SHA512

2b2cebb8eb5f9552bce0c4d2ba9cff54d77e210486578fb33ce93a6c786152d868cab92dc2f987e2ee4c7d7caa9e64956b489353225830ef929513c3277776e9
SSDEEP

6144:Ad86NSG8Y3cIb3tUx8iSm+EEM2E1lwd6zn/SWGF:Ad1NSG8cbb3Ox8iyo1lwtF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28
PID 1088 wrote to memory of 1668	1088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll,#1
  2⤵
  PID:1668

memory/1668-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download