0b94fa936cf22e269c267d4c28ddcc3b8dbc15dd74d3c6c0ca30e9d12bead3a4

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 20:17

Target

0b94fa936cf22e269c267d4c28ddcc3b8dbc15dd74d3c6c0ca30e9d12bead3a4.dll
Size

33KB
MD5

2ae1500e4597bc198d5c48d118b5d4bf
SHA1

2cc859ea79eba6491b63feeb918a7a7fb5de5e23
SHA256

0b94fa936cf22e269c267d4c28ddcc3b8dbc15dd74d3c6c0ca30e9d12bead3a4
SHA512

0c416b0ae36708923a27b0efc774d0de57d90a5db7faf474f62a880b5737e7da03744d270b4dab7848b10aa0e0a4ce098e7ce93f7f8b7b795f5efb7eb42709f9
SSDEEP

768:GtC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+b:GtwgAEw0kY87EWddgWk+Rd+b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b94fa936cf22e269c267d4c28ddcc3b8dbc15dd74d3c6c0ca30e9d12bead3a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b94fa936cf22e269c267d4c28ddcc3b8dbc15dd74d3c6c0ca30e9d12bead3a4.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download