9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:52

Target

9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll
Size

54KB
MD5

ff7fbc20164137731aebbd6c429a41b7
SHA1

a44b08de35934bae77340db357ebc978d8e6be2b
SHA256

9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081
SHA512

c03fa7b2bf86ceebfa2e6292960a205bc59271001591f08e84d9332be6f4e2a428041d4a9a7654889d8e1efacc11ca8d9d2937dd714d8d40c2eba9eb9177b3c2
SSDEEP

768:4xFmDJua1lNAF3LjH+ERkS+iNWMMzXNV+MP0qozftJ0cF61in3jPT/BQR68C:4xFcH1W3/eXh17zdEMtozVJrF6En7P9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1976	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll,#1
2⤵
PID:1976

memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download