e1acfe728590e764de059529151aebd213750de01719d8c48a8309b0715f1d66

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:50

Target

e1acfe728590e764de059529151aebd213750de01719d8c48a8309b0715f1d66.dll
Size

7KB
MD5

9eaff877ab86870818ba48bf8157fd00
SHA1

fa42ea4ca0bfd34649fc36194590fc37c0ef3412
SHA256

e1acfe728590e764de059529151aebd213750de01719d8c48a8309b0715f1d66
SHA512

7b69699da10d043712733c4621ff228030a26722cf27e8d9a8a56fd2d2c4156c7f3c208d4ba7b1d6faee4ec50470eae32cbaf94ad0dd627306552defbe176acc
SSDEEP

96:z0QR9B6BvAwb7rBA/ddq3Ui/vusJusM8tw/OqPgd/L/Hs9:JR94/b7V6ddq3U0vusgsLw/zPgNjM9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1acfe728590e764de059529151aebd213750de01719d8c48a8309b0715f1d66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1acfe728590e764de059529151aebd213750de01719d8c48a8309b0715f1d66.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download