ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe

Analysis

max time kernel
40s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 02:05

Target

73eba15dc8ebe4f5e2ff5b38b03f5813.dll
Size

223KB
MD5

73eba15dc8ebe4f5e2ff5b38b03f5813
SHA1

9da5119da4d6f80215e5831a13579fdc639a836b
SHA256

ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe
SHA512

0da7bd0a5405b2be9e993ea87ccaef7d8c81e621ccb4cd8a37aca4c1bee173ae277e7f9d46bce58a74e6e29055999ae6ae53138a0e7cb326f397a52a222a6fba
SSDEEP

3072:y/pW3srl+mxFh0Iea2MHep5Cdr8iY2hsK/6LsLF+3H:yBN+kFh0IH2M+p5Cyf2h9/ve

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73eba15dc8ebe4f5e2ff5b38b03f5813.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73eba15dc8ebe4f5e2ff5b38b03f5813.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download