1478000a6922ab2cda5de4271844cebd50d4cec4bbba218a494014634ee97e74

Analysis

max time kernel
16s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:11

Target

1478000a6922ab2cda5de4271844cebd50d4cec4bbba218a494014634ee97e74.dll
Size

6KB
MD5

70efa4cb6177da53453b3c7f0b8989e0
SHA1

dd82b62e4bc6dfdee0bb8223c84dcabe89c5c4ef
SHA256

1478000a6922ab2cda5de4271844cebd50d4cec4bbba218a494014634ee97e74
SHA512

6d7bd4ab1a59e11f64322c3a6e8255e40f506451910480ee42d9991cebeb815e5c1a135639520ed2725c9b7e4e176c86564bfbadd86e9bc46e52932dd51cf200
SSDEEP

96:Hxvtj+jhjvj3jcZGOiIVrYRp/JhUydQpGhGgvi+W7KYr:H5t6djbgYR2Bv7Fr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1478000a6922ab2cda5de4271844cebd50d4cec4bbba218a494014634ee97e74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1478000a6922ab2cda5de4271844cebd50d4cec4bbba218a494014634ee97e74.dll,#1
  2⤵
  PID:1408

memory/1408-54-0x0000000000000000-mapping.dmp

Download
memory/1408-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download