f1db01db881b139cdf4610710a210d14da223ddeac8eb58f4bbbb2340862b404

Analysis

max time kernel
233s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:33

Target

f1db01db881b139cdf4610710a210d14da223ddeac8eb58f4bbbb2340862b404.dll
Size

5KB
MD5

ab33f5d88a2d5cf28adb0a2ec3fa14d0
SHA1

6e4c31999d40fcfc19984ce77f2a156daf39f7e8
SHA256

f1db01db881b139cdf4610710a210d14da223ddeac8eb58f4bbbb2340862b404
SHA512

99b023fab7b5e5a5db560a0b91c660b8290489cfa2d638fd5ed44dd96a0bb3fe2dd29347907901cc7396833a449e8d3b262fac39cc98e0b013f2090e0c63a06e
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXruhlVX0:1h9jTqMMrY0OI/KYyznSMQW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1db01db881b139cdf4610710a210d14da223ddeac8eb58f4bbbb2340862b404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1db01db881b139cdf4610710a210d14da223ddeac8eb58f4bbbb2340862b404.dll,#1
  2⤵
  PID:1916

memory/1916-55-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download