3308563f4bb9dd606147d3fad442490fde20e95ac8dd615101ac0299f6ad515e

Analysis

max time kernel
51s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:05

Target

3308563f4bb9dd606147d3fad442490fde20e95ac8dd615101ac0299f6ad515e.dll
Size

7KB
MD5

7721f22bfcf6a570c97dad653c912a50
SHA1

f75bc577a578e8fe9f8b3571f2a3a6dbc51db2e9
SHA256

3308563f4bb9dd606147d3fad442490fde20e95ac8dd615101ac0299f6ad515e
SHA512

73f1e7ec0f29e9e2324a47cb7ae8b3ad3ab331a33ad05e21db3893ba9773b3fc62d419cdc60306d8e9b29b3228d9d8b8708f5f54198f3252f99c486c90bad1ab
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiVefd4tMbgTJvEv+htHikjYju9:XUcA+ggd+W/If0ifwo/JvEv+htl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28
PID 1744 wrote to memory of 1696	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3308563f4bb9dd606147d3fad442490fde20e95ac8dd615101ac0299f6ad515e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3308563f4bb9dd606147d3fad442490fde20e95ac8dd615101ac0299f6ad515e.dll,#1
  2⤵
  PID:1696

memory/1696-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download