906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:48

Target

906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll
Size

162KB
MD5

c2278779418d30a057f52c030fe754f0
SHA1

8b3333c1bc3abd91b6ee8e2640852677340e5047
SHA256

906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54
SHA512

ec2d557ceefefb6a99e99cf18ed75a9803be17a4babfe9e001f23fcabcda3ad1cdc52a1efff787c3ee985566158c426e4a8e3e49429fa50ac7803dd8ac88cdf8
SSDEEP

3072:ETL3VCQxJHVzlIQP9nfcmHsrQg78Bq3momZTuqtCW1xziMqqDa/0ueYqZFVC:ETLdf1TfsrQNY2oyUe1qqDG3l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll,#1
  2⤵
  PID:1284

memory/1284-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download