11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:22

Target

11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll
Size

6KB
MD5

36fcb0f2aa94c923c7da18b651c0cd40
SHA1

3982bc2ae37e7d6562278de701f9d16431dc5224
SHA256

11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69
SHA512

7aa76909a5e0ea11211a7c5197cab9d61766e091f8330cb18152729bc9c10cdceaa72f73bd72caf20beed5b893a07534a216dfdffb5c99810e4a48b32bd44001
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7PVKPx:nGTWJGp0UZUd6378snt7tw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26
PID 1720 wrote to memory of 1772	1720	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll,#1
  2⤵
  PID:1772

memory/1772-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download