65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:01

Target

65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll
Size

72KB
MD5

0422af5e1d4f29423dbead49e76fd460
SHA1

a35a04089b3599844ccbf93afde418d453933887
SHA256

65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee
SHA512

86359b653c9e47e2d5b5d47c8e10086db8a1fe0f70b09ac101d92ea317e02b70bebeec7a86e3ee3e9584718d448a49a7758a85e05a8e68fc139a72b4376f7452
SSDEEP

768:9doYItUVp4TbQcthznmqfUyML/iAPeQjmhILuaGF8AHpkSqTps:9doXtUETRUBP9uBtHFqTq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download