60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:35

Target

60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll
Size

6KB
MD5

a97177fee1251187a5ea5c4bb6d2e120
SHA1

0e7edb916a531bd25209074fbbadafc90f8c94c0
SHA256

60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8
SHA512

2df73d082b9b7c4a998e67dee42bfbc4d494b8bde613033a823c742d4e8a3e1c0bc1f2778ac10ddbd218eaeb4aeec29bdec6dbfeed3f09dcdabe190bcb11a6a8
SSDEEP

96:nEY2RrF1eqwi4yJ5OuuYEFIp1pTxZs8hISXl33eamWH:EHRh1eppyJ5P1M8hISXl3OWH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download