6ebcb29e2b662b6856fd22ac22e77eb9913b46621def2c2afdce35cb7df0f1c2

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 23:01

Target

6ebcb29e2b662b6856fd22ac22e77eb9913b46621def2c2afdce35cb7df0f1c2.dll
Size

116KB
MD5

d861edf6c78ad0a0ebd6cd68137767ed
SHA1

535f89440a936b94e303afb14ee3f37e8c855242
SHA256

6ebcb29e2b662b6856fd22ac22e77eb9913b46621def2c2afdce35cb7df0f1c2
SHA512

f882194c306f88e46d66e34a5065549a98efcfd6c3417ecc31d0ba5c08e9710771553ed2b27f29ca408507044a54c32ebfc0ceac70b8bd6ee7af5cdf05a8cae9
SSDEEP

3072:O22i653Fz2rbQ7pzaIc8Z7gO/HuNsisTaxm:OLpc8lgaLi5c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27
PID 1048 wrote to memory of 1928	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ebcb29e2b662b6856fd22ac22e77eb9913b46621def2c2afdce35cb7df0f1c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ebcb29e2b662b6856fd22ac22e77eb9913b46621def2c2afdce35cb7df0f1c2.dll,#1
  2⤵
  PID:1928

memory/1928-54-0x0000000000000000-mapping.dmp

Download
memory/1928-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download