9cba74a080bb699ae69cb0237256f5d7e79e4e0d70a614578da41d954fdd4896

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:24

Target

9cba74a080bb699ae69cb0237256f5d7e79e4e0d70a614578da41d954fdd4896.dll
Size

119KB
MD5

8c3aeda2cd2850bafce4056661f84a0f
SHA1

ac25c3c0028333b6ee6493aba15d4fa23ba66b4b
SHA256

9cba74a080bb699ae69cb0237256f5d7e79e4e0d70a614578da41d954fdd4896
SHA512

8e4988cd2078e70b5ffea5db7ec3a3f41196d9ba24f4df66da91a50d5de6d7876c4bd8512f250ac9a6da1a241fdac4d1488e6e6bc46c3e067203d60c110f64cd
SSDEEP

3072:OVV2P/XMiIlZF62gS+7os9N/ox4oWVJp:OziIlZ425+hNBr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27
PID 1256 wrote to memory of 1712	1256	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cba74a080bb699ae69cb0237256f5d7e79e4e0d70a614578da41d954fdd4896.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cba74a080bb699ae69cb0237256f5d7e79e4e0d70a614578da41d954fdd4896.dll,#1
  2⤵
  PID:1712

memory/1712-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download