20f8e776322b9df6d8706ff934ab76b2f5a8416e391e6fcf225443e66b527eb4

Analysis

max time kernel
58s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:08

Target

20f8e776322b9df6d8706ff934ab76b2f5a8416e391e6fcf225443e66b527eb4.dll
Size

4KB
MD5

606299fee40e0d46a32c07aa947adbd0
SHA1

1709227ddddced24994140ba99e58c145d3caef0
SHA256

20f8e776322b9df6d8706ff934ab76b2f5a8416e391e6fcf225443e66b527eb4
SHA512

0cc7b1a8a91ece6e43dc77d910894e94433c47191162627635839f541a3020486e99df32a388618b597d1e7a2182d42949f5bd799c433fd0c183f4d9896f997c
SSDEEP

48:a7Q2voyT+Bt5a9+VzUo1V3i3Fm1+5nbosmWyfd:qT+ZKeliVmmbFgd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28
PID 2040 wrote to memory of 1372	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20f8e776322b9df6d8706ff934ab76b2f5a8416e391e6fcf225443e66b527eb4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20f8e776322b9df6d8706ff934ab76b2f5a8416e391e6fcf225443e66b527eb4.dll,#1
  2⤵
  PID:1372

memory/1372-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download