109642c2856e3f3ab0bd6c80dbdf0bedab4024978f9efdac765fb7ec725cc867

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:13

Target

109642c2856e3f3ab0bd6c80dbdf0bedab4024978f9efdac765fb7ec725cc867.dll
Size

222KB
MD5

6ed7919967e1f200ea9aafc23ba426c0
SHA1

aaf08ab6c1ac5c348dc1656b3d803924d077b797
SHA256

109642c2856e3f3ab0bd6c80dbdf0bedab4024978f9efdac765fb7ec725cc867
SHA512

aa60071957e515646be7afb9d7aecf16336c0423d8216692a07d0bdc2831afc939d871ee315a85d0ed835c72129e807f95ea11a4648e007f1c55f8df2faf8f2f
SSDEEP

3072:yFc+FoEGHm84TRzJIu5CjoFF5fUxqkts9MeZ3fxXltGapQe5hdjqLnQmv+ky:Zh4ZJI3joFFhUxveZ3fpDpQYhFqF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28
PID 764 wrote to memory of 1304	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\109642c2856e3f3ab0bd6c80dbdf0bedab4024978f9efdac765fb7ec725cc867.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\109642c2856e3f3ab0bd6c80dbdf0bedab4024978f9efdac765fb7ec725cc867.dll,#1
  2⤵
  PID:1304

memory/1304-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download