f01abdf7909967ae2b2fa4e56f8c9c8dcf1ad615f56e49d28250ca90d172e4b0

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:46

Target

f01abdf7909967ae2b2fa4e56f8c9c8dcf1ad615f56e49d28250ca90d172e4b0.dll
Size

4KB
MD5

e9fb3c162b11fa1473ce2f95cc0b9ea0
SHA1

8366ea78167e08e75983a318dc9bc3916d4e7040
SHA256

f01abdf7909967ae2b2fa4e56f8c9c8dcf1ad615f56e49d28250ca90d172e4b0
SHA512

4f9556faf5ec69693559b545d37709c74ae6e8a5a15fafa677cc11f1bb875c09f20a124218d821e4ca98a35327e0aa2b6431ae57911f6ea3c8ec1d4d2b44ab96
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LqGFx6ue6cTTyA/3eSrn:TRphMzf8qGFku/0y2Prn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01abdf7909967ae2b2fa4e56f8c9c8dcf1ad615f56e49d28250ca90d172e4b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01abdf7909967ae2b2fa4e56f8c9c8dcf1ad615f56e49d28250ca90d172e4b0.dll,#1
  2⤵
  PID:1360

memory/1360-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download