faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60

Analysis

max time kernel
160s
max time network
76s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 15:54

Target

faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll
Size

15KB
MD5

0ee8b5f6d688b07387052688c3ddc259
SHA1

c2d1ea4b5e0317efb129cdee03a9e781ee3a7637
SHA256

faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60
SHA512

af752432bb31c056f80bc0bed71ad604bfa12893c785a8f1cba98c070630e311b78c69aed6df44abfe5c193c076c9f8c4428a59d10bc93c138030b38f71f8234
SSDEEP

192:vvsh4BfiN1VFLEW0Ui/JKWTSZm4/VfsbmN1aV0MSoJdXeykYKWxVoD+cLk:XshegwUYKWTSZmCfMmNgWMSoJevXrL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28
PID 1560 wrote to memory of 1296	1560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll,#1
  2⤵
  PID:1296

memory/1296-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1296-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1296-57-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download