6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712

Analysis

max time kernel
220s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:16

Target

6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll
Size

109KB
MD5

62d6242c7db6c7d0970a68bee3d55a72
SHA1

3a8ae92ea2a9399510395431d93db0c636ca3f9b
SHA256

6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712
SHA512

04daa131616c221dbc91d7725240418c43aebdbd18c84a54f7664778afc1c86075b01ac86596b1299ee7a958174a11b41f3650cd4b8f92380a5caac1d2a2331a
SSDEEP

1536:cmfbFBKxnBbnErvv8hRfxNZVsreWdCMALOtw4ly/9FTgo9uxAc7sDh4+WMaiCq:jZQxnEgNZSmMAnRNuxfsDh4+s0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28
PID 512 wrote to memory of 520	512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll,#1
  2⤵
  PID:520

memory/520-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download