a9b8dd2dddc72c664fbcca37e02321efb5c982b220b72da7c353e069855e88af

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:30

Target

a9b8dd2dddc72c664fbcca37e02321efb5c982b220b72da7c353e069855e88af.dll
Size

6KB
MD5

bf686675b28184829621f089760e1a20
SHA1

01c172fd5249b72f422cae053914d82f72f64ba1
SHA256

a9b8dd2dddc72c664fbcca37e02321efb5c982b220b72da7c353e069855e88af
SHA512

0c8e7a52632efc833d49f3ab2fa7e6f78c7d6d555ad5013d0a20c7f8b137662cb06060b57ea5ee42951e6c86cb20abe93ab66a5bfa634236d713b82da9d4de14
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7XbETG:juLJ/oAdQPQa2aeng7r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27
PID 868 wrote to memory of 552	868	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9b8dd2dddc72c664fbcca37e02321efb5c982b220b72da7c353e069855e88af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9b8dd2dddc72c664fbcca37e02321efb5c982b220b72da7c353e069855e88af.dll,#1
  2⤵
  PID:552

memory/552-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download