6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61

Analysis

max time kernel
37s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:12

Target

6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll
Size

137KB
MD5

240ec9e39dff4617568f3d1c8adad9b0
SHA1

27a59ddc11548aaf55f451459b6a78ae47bcfdd0
SHA256

6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61
SHA512

07d458dceaadd261120d560704163a0b13a1d371d62282446f0256e056664770c8003d9d18ae0f1efad3891037313fed7225f213b663af8797a898a29aef613c
SSDEEP

3072:q8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxn0ILV:q8w6D4Kotup0LWI+fn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28
PID 940 wrote to memory of 1932	940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll,#1
  2⤵
  PID:1932

memory/1932-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x0000000000161000-0x000000000017C000-memory.dmp

Filesize
108KB

Download