6b2ba2d6794a0dd5c54c6b045eda1d2ed7dfa4f93f556c0187e5db84810db94a

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:06

Target

6b2ba2d6794a0dd5c54c6b045eda1d2ed7dfa4f93f556c0187e5db84810db94a.dll
Size

230KB
MD5

7498b4db2ce5f77e164399ea934bb74d
SHA1

94153b89022c346e10418fea6038c70dd845a078
SHA256

6b2ba2d6794a0dd5c54c6b045eda1d2ed7dfa4f93f556c0187e5db84810db94a
SHA512

c9f3358e674467e48ce65ff8b6c5e093d06b8ca7a0e57a5599e3edf91947ec59a2ae4a96d46dccfdd50661050e7eadfc5e0a464727a6e32d1025f1f01f38a1f9
SSDEEP

3072:8FAObGZYsmyoIxIsU2en1fVWCbtkJRDiFF3EqwgrEDgJgA07N0slGp2gvoqrRes2:ZiKeGiFFU8EDgJyPOBvnO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27
PID 1736 wrote to memory of 1340	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2ba2d6794a0dd5c54c6b045eda1d2ed7dfa4f93f556c0187e5db84810db94a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2ba2d6794a0dd5c54c6b045eda1d2ed7dfa4f93f556c0187e5db84810db94a.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download