f0cd128dd2971a9a107b953d867a66c59d747c7c75385b3f29e4ffb5fe68d9b8

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:05

Target

f0cd128dd2971a9a107b953d867a66c59d747c7c75385b3f29e4ffb5fe68d9b8.dll
Size

60KB
MD5

6db994f48db355cec6e89f3113611f41
SHA1

4b37f5b79a57d01b25ec2476ebe3b02c6a362d5e
SHA256

f0cd128dd2971a9a107b953d867a66c59d747c7c75385b3f29e4ffb5fe68d9b8
SHA512

8b8e74e1e03da7fefa87803abf8e9e78b7ca5721190181ffb946cfe02bae1dd2a77e38a2215c9416b7cb6cb4cda95d41bef136d5595055a1b5c9e7603e311785
SSDEEP

1536:hZAg7+ykkBlIhz/zxoUrhqzzyHAwaZ3S2H:hZl+3kfIhZ/rUyKS2H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cd128dd2971a9a107b953d867a66c59d747c7c75385b3f29e4ffb5fe68d9b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cd128dd2971a9a107b953d867a66c59d747c7c75385b3f29e4ffb5fe68d9b8.dll,#1
  2⤵
  PID:1364

memory/1364-54-0x0000000000000000-mapping.dmp

Download
memory/1364-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download