2f10713497766e5d2776b65633856a1c6258780dbb8429479617be9d8975f528

Analysis

max time kernel
42s
max time network
59s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:49

Target

GetUserPassWord.dll
Size

120KB
MD5

a1c63e706705a141ceb958b58c808ef0
SHA1

bf3ddcc9804d6422d7e7a2ea4a8c7679cdb62208
SHA256

4051356f6966dafc85f5a327271cbd105161bb1e0b8b9ff392f44d450c9bbd9e
SHA512

d3bfb35d1ca3b3e0d9f525ed7b001416ad7ae8120b90d876845ded331a9fb76360a615abc41c177d4db23d62da618cb98841ed017f2283c6b633b3a3aa698d31
SSDEEP

1536:ySDV52V7HTLTrksPfteRIU+CWNWJQq5oxniBMWqOLeBnWP8oIcKBrJoybDg+Fg:y+5Es809rWAho5iBsdoIcOrOybzFg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28
PID 2000 wrote to memory of 1948	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetUserPassWord.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GetUserPassWord.dll,#1
  2⤵
  PID:1948

memory/1948-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download