7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:10

Target

7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll
Size

48KB
MD5

98995ef6dd059b1a97e8d92edc75f530
SHA1

17d8f5606858081fd6b0233d5a52126dd05b8d79
SHA256

7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f
SHA512

c6f628eaf0b2bfee121357873b6324c87f8a848bff2cc78fbc819950f1c60b332f53f1e3619f6fa2127f20b29abe9379a298e9b2f9ea878483f4d3a9a6944e3a
SSDEEP

768:UJIGvAAZQhETQP44iAUrJFEBjiHIjho3wIa4VhMbIs9E7v4MLXBnkCvHvpX7CBue:UJI8Ac0AFMmL3wIrVmbIdDbRLvPpXIue

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27
PID 892 wrote to memory of 952	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll,#1
  2⤵
  PID:952

memory/952-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download