6aef49a34d69189cd21d9a6210395f96a229adf4b909733bf6837d9dca50038f

Analysis

max time kernel
80s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:44

Target

6aef49a34d69189cd21d9a6210395f96a229adf4b909733bf6837d9dca50038f.dll
Size

22KB
MD5

855ac0e7316d400a1a8f443dfb6ed58a
SHA1

7009be8463a9f582655e23a8f2b9e34c039447aa
SHA256

6aef49a34d69189cd21d9a6210395f96a229adf4b909733bf6837d9dca50038f
SHA512

04f04dc61efd14e8a532ba2bab946199b2ae181af8efa274d2be81e564a35a368e4697b2a83096241882d57fd3982c9fdd02a15b532b8badd5de8e2df5b7ce71
SSDEEP

384:pjI63POq+MzeuWRaOFX8P+BvbYIFSJkmDAz:pb/nBze/PRBJbYmSnDM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 948	1952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aef49a34d69189cd21d9a6210395f96a229adf4b909733bf6837d9dca50038f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aef49a34d69189cd21d9a6210395f96a229adf4b909733bf6837d9dca50038f.dll,#1
  2⤵
  PID:948

memory/948-54-0x0000000000000000-mapping.dmp

Download
memory/948-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download