efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7

Analysis

max time kernel
12s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 08:28

Target

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll
Size

500KB
MD5

be231f7879d8d2159b67b7f277527268
SHA1

d73ca3707ebd61eff15dc25d9f439d6060553818
SHA256

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7
SHA512

54ebf014160f0d5e1912d6495bc62e122296e055b548c90b63dabe1a24af6f29ec80d08eb7fe204702b2e263603f68c0e9f534e98917eb325b6dba524e20cb82
SSDEEP

6144:RQg1U4oSvkDjQ3cCT+jFa2QuoT50qWphYWxhaGqE:Rn1/ZcDM3d+a2QB0R/YWxQZE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe
PID 296 wrote to memory of 1788	296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll,#1
2⤵
PID:1788

memory/1788-54-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download