864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 01:48

Target

864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll
Size

33KB
MD5

9efd3fd52f20833b9278d5e1bac96a5a
SHA1

4c56b1cad516e4965e076ebcd1c6851a38fedaf2
SHA256

864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb
SHA512

d132e4dee2dc7a3d23bd1a0dbec6407a19d2c4cccc8d027280f1a7fc12377fac58910b7d77b849454abf3f471a99586dad81c5e40d52fdd7884f20c8a830d47f
SSDEEP

768:iAdVo1OwNMZi9LIj5u0hvVqYgr0ziY9m570vi:iAd8OQMAGnvWY9m10vi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27
PID 2032 wrote to memory of 1068	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll,#1
  2⤵
  PID:1068

memory/1068-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download