b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 21:20

Target

b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll
Size

5KB
MD5

00b648b9bcca782501233d80fbd40490
SHA1

af1104cfe088df83d236022f0dad4814032e3093
SHA256

b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22
SHA512

72902a2f1afeb5de140153c018dc54fa0107320a8ac0aff1a2a8cbbaa1eb4283ec075251104b899d589d359927118f143d4179065f7b035b1d0cdb376f1c61e7
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaijFmKTi:XUcA+ggd+W/If0ilFti

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll,#1
  2⤵
  PID:1124

memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download