9a51cd6d7bcfa62f8eb4817edfd77406673e72b2352e73d93f151450a2cb6546

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:46

Target

9a51cd6d7bcfa62f8eb4817edfd77406673e72b2352e73d93f151450a2cb6546.dll
Size

6KB
MD5

5c396af08763a1b4498a0cf6a9234470
SHA1

1d7c86eb88964793e49f787e25198faf6f603744
SHA256

9a51cd6d7bcfa62f8eb4817edfd77406673e72b2352e73d93f151450a2cb6546
SHA512

62afd5eb2bf6deabd39e3486a3772f26d856289c1808be27d5c5f22711b2deb7a4611b21584b20b3eb4a18f79b61515892e72f7d307626871aa87d8ca782afac
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIU0hMSkJFlq4rOMOhKmjyjdbPq:unSR6bgYcqzMyjd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24
PID 1224 wrote to memory of 956	1224	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a51cd6d7bcfa62f8eb4817edfd77406673e72b2352e73d93f151450a2cb6546.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a51cd6d7bcfa62f8eb4817edfd77406673e72b2352e73d93f151450a2cb6546.dll,#1
  2⤵
  PID:956

memory/956-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download