06fc350c4d8f50f9747190009617e64265483c11455e26171948fc57c38ba782

Analysis

max time kernel
58s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:53

Target

06fc350c4d8f50f9747190009617e64265483c11455e26171948fc57c38ba782.dll
Size

251KB
MD5

bf1b0043af3c0add7ce8f73b9578bdf0
SHA1

8d723f0b04a7fa958348a1a369c6353e8e6d0f5e
SHA256

06fc350c4d8f50f9747190009617e64265483c11455e26171948fc57c38ba782
SHA512

b5d56767ddf5a40099de250be18e42c0810f8a0d44a1fb989b441168ff43a4c1dfce43a88f9571783e15e3048532409252654632bca81e1636f19759c4a863df
SSDEEP

1536:3aIHIJkuvfZ/AuwxJS6pc6YU59aPjgZGf9YAlpLBN071tf2CnCHtSi56gK6Um/u5:qkyxvfGx/RYUKMgpLBN8BIJ656UmG5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28
PID 2036 wrote to memory of 1308	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06fc350c4d8f50f9747190009617e64265483c11455e26171948fc57c38ba782.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06fc350c4d8f50f9747190009617e64265483c11455e26171948fc57c38ba782.dll,#1
  2⤵
  PID:1308

memory/1308-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1308-56-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download