ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39

Analysis

max time kernel
13s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:45

Target

ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll
Size

52KB
MD5

af13adda97d663e73cd3f84271ee4f99
SHA1

fc04104a3b1f0293ccae860a885f7fe9cf6805ec
SHA256

ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39
SHA512

0b6c90d2f756ca9d673d029317262b302b1604a7dae72b5fa93254c8bcd05aaeadad617eb88557a71333b97b5bdba6373e58178e6393dc22ec80900abefd8837
SSDEEP

768:w/6hTRyNSIluiWzXQSh0OMgnPH9iQmgu985fQK86yYjUEiily03eXo9eJi6:wyhty/7WzR210cMuDK+YjUEiiEsiogT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1628	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll,#1
2⤵
PID:1628

memory/1628-54-0x0000000000000000-mapping.dmp

Download
memory/1628-55-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download