a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:20

Target

a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll
Size

6KB
MD5

0f45bf7a173ee47b1523b6d2eb56c4b0
SHA1

4c35f1d9c934dfeae6bc0b04c41c57aafea33244
SHA256

a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf
SHA512

6ab39c4b757a4f7421f50bac758ecec957abe4b59d327efedbe45b4e490366caa5103396ce57eba71eb2a2968c7dcdb01853a75d8560f28d549f4f248b2ce419
SSDEEP

96:nI2RrUeqYEIsUxkxkHQFmxIhZ5b2Hfru7l:XR4eda2wK/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28
PID 1784 wrote to memory of 892	1784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll,#1
  2⤵
  PID:892

memory/892-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download