6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:22

Target

6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll
Size

203KB
MD5

2079d75ce6794ea85a093d621b757100
SHA1

6e424ec139a0980f41df86d243db7889bd9d9561
SHA256

6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f
SHA512

31d1f582edbb7885f2f2cfb3be8cafde9d73209c840ae96dd9dec963f4a57c2ed5e96fdff76b78be09ba233900324898137f7881a2e40ae1ceef44867396c52b
SSDEEP

3072:9h+2weEohlRyaBluJfu7YyrgtnQCedYjJ+XSX4deo60rwvAlt:rxXrlyaiJE5g1QlkkXSIdex0rrl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27
PID 2028 wrote to memory of 2032	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download