9dfc9dd37a60233b4011c27e735d10ab80ddfa74f31a447790e3d517a76d05ec

Analysis

max time kernel
73s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:45

Target

9dfc9dd37a60233b4011c27e735d10ab80ddfa74f31a447790e3d517a76d05ec.dll
Size

6KB
MD5

4c0925fe2534937a97d4f762426bd6c0
SHA1

c6d5256a9ac1eab67e812301c4eeafea7ebe4ee1
SHA256

9dfc9dd37a60233b4011c27e735d10ab80ddfa74f31a447790e3d517a76d05ec
SHA512

1cc4d008fc404b7b729117fffd6d241c4c51c97cd0d46159451e1c0f04b97d433a0325bb7eb4eb8b3acf5bdf81a1d5f4bab925a35d0f1e80c0f4d3ec94fd385f
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIQ/YSzYOWpg/V7FdKzpDw:unSR6bgYLzyOh+1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28
PID 1484 wrote to memory of 1120	1484	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfc9dd37a60233b4011c27e735d10ab80ddfa74f31a447790e3d517a76d05ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfc9dd37a60233b4011c27e735d10ab80ddfa74f31a447790e3d517a76d05ec.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download