6d0659950e71cf5f63f2661a0020fc01b3099560d393f2cf606b6dd18afce1dd

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:46

Target

6d0659950e71cf5f63f2661a0020fc01b3099560d393f2cf606b6dd18afce1dd.dll
Size

4KB
MD5

2bc1a97b3bdf193b33da81467fff84fa
SHA1

6561d62355c7745b4f2120986bd5f717f86483b7
SHA256

6d0659950e71cf5f63f2661a0020fc01b3099560d393f2cf606b6dd18afce1dd
SHA512

6c6b372b92c2dbd03bf5efe71f86feb73cfb2e68ea6f8ad2ad8f59fed2f4f74c7fff1200de7857f56e1185cafe665b38feb73a96218880bfa2d27ef43d46abb9
SSDEEP

48:a7Q2voyT+Bt5a9C4HZlQCXgtJitSczgSaYVm:qT+ZKC4MCQ/isctaOm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 536	768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d0659950e71cf5f63f2661a0020fc01b3099560d393f2cf606b6dd18afce1dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d0659950e71cf5f63f2661a0020fc01b3099560d393f2cf606b6dd18afce1dd.dll,#1
  2⤵
  PID:536

memory/536-54-0x0000000000000000-mapping.dmp

Download
memory/536-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download