73afee9dde4e75f9e2dcd37428cc55761ecee17c06f42e8fd258ac9356724c70

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:53

Target

73afee9dde4e75f9e2dcd37428cc55761ecee17c06f42e8fd258ac9356724c70.dll
Size

7KB
MD5

66c94c86b2f97f161f3900988db68730
SHA1

fb2f1f9f6bba8462703ca5436dfaa01721c20dbb
SHA256

73afee9dde4e75f9e2dcd37428cc55761ecee17c06f42e8fd258ac9356724c70
SHA512

8a3f1416cd2d7996e56bf5a4fc09b48f77b80813021e30648a646a0efedc53132e582989fcad6b575afff5f289307a4e25527fa046bb7e2e160ccb63c5f47511
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRO9Obv9AjrFaQqDKfjAtYBs9To+/I0:YX8kYBsH/c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28
PID 2044 wrote to memory of 1736	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73afee9dde4e75f9e2dcd37428cc55761ecee17c06f42e8fd258ac9356724c70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73afee9dde4e75f9e2dcd37428cc55761ecee17c06f42e8fd258ac9356724c70.dll,#1
  2⤵
  PID:1736

memory/1736-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download