6f82d10dbcb95d85426e3ad9cea96bfac5b1b4dc07596474cccb1ae58d728284

Analysis

max time kernel
18s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:45

Target

6f82d10dbcb95d85426e3ad9cea96bfac5b1b4dc07596474cccb1ae58d728284.dll
Size

6KB
MD5

2ee734be96fd25172303da8731b91d90
SHA1

d054624385d2ebd8f6453a0e63c894acdffb9e6b
SHA256

6f82d10dbcb95d85426e3ad9cea96bfac5b1b4dc07596474cccb1ae58d728284
SHA512

9bdd8a383cff535cc7e49792e9b29e9777fd8bd05e958d7800cde0f30ce9b64a255509f14c9d31940d0ce63dea4e9e485c65c582276b0185190a1a3113d466f4
SSDEEP

96:WLRxkjujtjd8jPjcZG2Uouqktvidjl2S0vPuMAtNV6vyqG:WtqKR6bgYIuHRidJ2HTA56vyqG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 956	1216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f82d10dbcb95d85426e3ad9cea96bfac5b1b4dc07596474cccb1ae58d728284.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f82d10dbcb95d85426e3ad9cea96bfac5b1b4dc07596474cccb1ae58d728284.dll,#1
  2⤵
  PID:956

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download