fe8954604eb2196b8d9e65fe37c50ea14ceeb062def2b5c559bd9d8dc178b2ff

Analysis

max time kernel
39s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 15:46

Target

fe8954604eb2196b8d9e65fe37c50ea14ceeb062def2b5c559bd9d8dc178b2ff.dll
Size

34KB
MD5

b1ef2f764f2e7e00cb46ac7dc5ba1c47
SHA1

4aa5b919a347785e78dba80d3078720a5642b2f9
SHA256

fe8954604eb2196b8d9e65fe37c50ea14ceeb062def2b5c559bd9d8dc178b2ff
SHA512

1fb247302248ecce9fa33a817346c7ae722a2d2db0e0f02a95c66f5a396aad706fb46a8e8bb364ab0ca605261a0220d70e94246fa520a27adbf0b5c30db543da
SSDEEP

768:u7mRDL0cgngbMzSJOQc7S/DftqqhnP0RROTi:OmRD7gHzS0d7S/1pMRROe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28
PID 1992 wrote to memory of 952	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe8954604eb2196b8d9e65fe37c50ea14ceeb062def2b5c559bd9d8dc178b2ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe8954604eb2196b8d9e65fe37c50ea14ceeb062def2b5c559bd9d8dc178b2ff.dll,#1
  2⤵
  PID:952

memory/952-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download