4fb36b38468cfa9ee9055e45c1de3404baa2e5da02f0456bd0a4193a9a55cb3c

Analysis

max time kernel
16s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:36

Target

4fb36b38468cfa9ee9055e45c1de3404baa2e5da02f0456bd0a4193a9a55cb3c.dll
Size

5KB
MD5

f9067a02c8c76af3c3f8009c92972b60
SHA1

843b265f96f8daf09c9eae1967853595f81017e8
SHA256

4fb36b38468cfa9ee9055e45c1de3404baa2e5da02f0456bd0a4193a9a55cb3c
SHA512

6952ca0a01d1e2588966f1b1d9c45b35bee5825e934748b93b1b07d05fca7ba06897fe6bcbe72702042c89617d1a7b4e0ab77f3fad1001b7a819184408b67bd5
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhvZfsV6K/9/Qex1zNlyrl+Q+cD6y:nEY2RrF1eqwi46QenzNGl+Q9HT4K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28
PID 2004 wrote to memory of 896	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fb36b38468cfa9ee9055e45c1de3404baa2e5da02f0456bd0a4193a9a55cb3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fb36b38468cfa9ee9055e45c1de3404baa2e5da02f0456bd0a4193a9a55cb3c.dll,#1
  2⤵
  PID:896

memory/896-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download