b22e6701cf266adbd9b5b622c31a114993c49fec431efef17b8cba70d7099fb6

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:41

Target

b22e6701cf266adbd9b5b622c31a114993c49fec431efef17b8cba70d7099fb6.dll
Size

6KB
MD5

298e039439878b7da631c9e960c17baf
SHA1

cbce22981cab35400ce9c3303ae24b2df71ac81b
SHA256

b22e6701cf266adbd9b5b622c31a114993c49fec431efef17b8cba70d7099fb6
SHA512

d08aebd0d281e9bc2855ff4b30814e1305d2b5804e8f883a587ec5b2afd44c414f8398eb30b18152b32cf318169fded92016a54091d14129aa464e347876ad8c
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHh6BTj9EYk/gxd+EwjfjaqjiBqZGr:nEY2RrF1eqwi4wBvztbZv5j9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 904	912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22e6701cf266adbd9b5b622c31a114993c49fec431efef17b8cba70d7099fb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22e6701cf266adbd9b5b622c31a114993c49fec431efef17b8cba70d7099fb6.dll,#1
  2⤵
  PID:904

memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download