9e7d29fdefa43226ba1a305d5ef10cc59509bf8683a65f9d4fc391974d096e2a

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:52

Target

9e7d29fdefa43226ba1a305d5ef10cc59509bf8683a65f9d4fc391974d096e2a.dll
Size

232KB
MD5

4774a4ea1ccd08c18dc0da616764eef0
SHA1

eb6d2b977833dd1b90d130b878f8796be03e84ce
SHA256

9e7d29fdefa43226ba1a305d5ef10cc59509bf8683a65f9d4fc391974d096e2a
SHA512

2a6ed398e64340fa53bc3d46c0247c81300feeaf647482456fbda799f06c718e69f07f9fa38ec85b3b12c1134d5a3b58a2cd0c0c271ac11a212fcddc624a941f
SSDEEP

6144:KeNFWAg3Zxl/qEDSGie+PslxOixcqTQIaR4qEEmh/fVpY:R6JfqEDSGitPsccaRSBY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28
PID 956 wrote to memory of 1664	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e7d29fdefa43226ba1a305d5ef10cc59509bf8683a65f9d4fc391974d096e2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e7d29fdefa43226ba1a305d5ef10cc59509bf8683a65f9d4fc391974d096e2a.dll,#1
  2⤵
  PID:1664

memory/1664-54-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download