06fb27ac220956d703ef8731a5665449a43239d425e8676c749a924a1c4c1c33

Analysis

max time kernel
40s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:57

Target

06fb27ac220956d703ef8731a5665449a43239d425e8676c749a924a1c4c1c33.dll
Size

4KB
MD5

be717c744e7a32179d261943d582ad60
SHA1

d7956dbf79bcc78da0a0e2f60efddbd35ee29876
SHA256

06fb27ac220956d703ef8731a5665449a43239d425e8676c749a924a1c4c1c33
SHA512

3ccb4af10a4d69484d260f9160bf11d8ada38fe7de3cae3688c255b2d8a72ff9a34dc9fe8382b5b827925687f093828c84301d34559240fefc1043854abbae38
SSDEEP

48:a5zjMTGcITBVQVE1lcLprLSdpHw1YYGzCO7oI3D1wFF/PG:iT3Qu8lgw1jGzC93hG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28
PID 1440 wrote to memory of 1448	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06fb27ac220956d703ef8731a5665449a43239d425e8676c749a924a1c4c1c33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06fb27ac220956d703ef8731a5665449a43239d425e8676c749a924a1c4c1c33.dll,#1
  2⤵
  PID:1448

memory/1448-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download