4f0dbb65ac31442697073b103d9a862b7638db4eca32ab1ab3b3797800fb785a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:00

Target

4f0dbb65ac31442697073b103d9a862b7638db4eca32ab1ab3b3797800fb785a.dll
Size

5KB
MD5

fefd892f51e302cd02e96a6334bdaa00
SHA1

703f3d4595a939546bd45c744e60a057989bb93c
SHA256

4f0dbb65ac31442697073b103d9a862b7638db4eca32ab1ab3b3797800fb785a
SHA512

24d36d31ea4cb6209d51b6fcb6cc2488a95ae11e133aa4e930f2e1c993013a297b4bf9f88221b1fcd6efc201487a0c1d3bea1e76c6accef8eea61d18d1f7e999
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4j7USMRAWGUr9yUzM/tocQxcZ:2M/SdjbgY+7UDSW1h3zMAcZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f0dbb65ac31442697073b103d9a862b7638db4eca32ab1ab3b3797800fb785a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f0dbb65ac31442697073b103d9a862b7638db4eca32ab1ab3b3797800fb785a.dll,#1
  2⤵
  PID:1708

memory/1708-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download