0c2f3f629e9a8858061cb7d1104d4d1bf207b011abce36ef9648be4d6bd5c1a8

Analysis

max time kernel
8s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:09

Target

0c2f3f629e9a8858061cb7d1104d4d1bf207b011abce36ef9648be4d6bd5c1a8.dll
Size

35KB
MD5

a12b2ea41cd9e2094df84d039c34d550
SHA1

4ea7121e7ac0452120264072b6772ecddcc16907
SHA256

0c2f3f629e9a8858061cb7d1104d4d1bf207b011abce36ef9648be4d6bd5c1a8
SHA512

2adfe0e9a35eb0320d3476e3a61bdc7e11b75988f2383e2865b7117b2108e9bcc0fef7327178bdfd57e631be227aaa05fae5dc8a121da85f2d494e6e4929eda9
SSDEEP

768:uSVslgsR16D1646Y8D55U7W4EXXIN/nNwRwxeD5:uSVstk8D07W4E+/iRwU9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2f3f629e9a8858061cb7d1104d4d1bf207b011abce36ef9648be4d6bd5c1a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2f3f629e9a8858061cb7d1104d4d1bf207b011abce36ef9648be4d6bd5c1a8.dll,#1
  2⤵
  PID:1712

memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download