ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:33

Target

ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll
Size

5KB
MD5

d0eca65ae62723100e07fe34d0a9bea0
SHA1

832d7a5c45e6a0dc48c4973c47fccd8f866f556d
SHA256

ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0
SHA512

1bfdf69b66b463d58caf9ee31027174b01d6d1cdc312c9ccdc0cec8b21c5e4e65afef442a4daf2b728a367c9878ffcfaad356c7c43c99b1e2023390c00147c16
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXrAz9zo:1h9jTqMMrY0OI/KYyznSMcZo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28
PID 1372 wrote to memory of 1680	1372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll,#1
  2⤵
  PID:1680

memory/1680-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download