01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:41

Target

01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll
Size

44KB
MD5

d72d81dd50325da54b9b79c95be8a1f9
SHA1

411fb245b43263cebf52a6aab8027fc3b77805fc
SHA256

01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403
SHA512

c135a8bc62b5d599e37847599e04bd2f507852c197be95c1c01161fd14c65ff67ca27cb3246c0e2ae217c3e3bd06f2152d0f8cadead60b4b2ad0b05f4f4098cb
SSDEEP

768:M9rDLswTpBaoELyVLrLNhdgjrYDh3Fhg/V:M9owTpBaoELSLegDpFe/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#1
  2⤵
  PID:1236

memory/1236-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download