af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94

Analysis

max time kernel
14s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 20:53

Target

af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll
Size

24KB
MD5

15ece60c7441486453a42f50b9f5a9eb
SHA1

2da7e79bf523dfdedc50321f5e7f41435b373bb7
SHA256

af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94
SHA512

3232220edb53c57e7064ef468331fcf40a41ad50119d3cc5ee3764191f965016ad4200512da9df9d43458983066a9a3b4ae7a4c294b85e073172c727bccba4c8
SSDEEP

192:zsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkr:zcG8W59LhtEQA/4O82FV9PS8Vkwkr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28
PID 1836 wrote to memory of 1672	1836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll,#1
  2⤵
  PID:1672

memory/1672-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download