eebbf3c96f74a9bdbe9eef05ada933bf57607ad4b107fcd70647c5bbfe83fa86

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:19

Target

eebbf3c96f74a9bdbe9eef05ada933bf57607ad4b107fcd70647c5bbfe83fa86.dll
Size

6KB
MD5

bf7996237313b8486c5e1c3a9276f9b0
SHA1

7ecb8c86523d928ffeb8d01b34135d980a546e21
SHA256

eebbf3c96f74a9bdbe9eef05ada933bf57607ad4b107fcd70647c5bbfe83fa86
SHA512

15c9ed14fc420933e90f8561f73cf945940f33e298fda155c25fb4db0768edac4ae4f67949bfdfeadc93b3dff803d1f2bc93aa8d5c57343e6845927041d8de66
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7YQoDPu:nGTWJGp0UZUd6378snt7YQoru

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebbf3c96f74a9bdbe9eef05ada933bf57607ad4b107fcd70647c5bbfe83fa86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebbf3c96f74a9bdbe9eef05ada933bf57607ad4b107fcd70647c5bbfe83fa86.dll,#1
  2⤵
  PID:1560

memory/1560-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download