d4ce0b6ffd35b6e5bfbd1f76a5f0d4c46bfad3b0c9a779054178e45fc2d0f97d

Analysis

max time kernel
39s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:53

Target

d4ce0b6ffd35b6e5bfbd1f76a5f0d4c46bfad3b0c9a779054178e45fc2d0f97d.dll
Size

6KB
MD5

65874d1d8687c09b38e44e9171661080
SHA1

182945c50ec6d23457f9d6b1f9004bd7241cfbeb
SHA256

d4ce0b6ffd35b6e5bfbd1f76a5f0d4c46bfad3b0c9a779054178e45fc2d0f97d
SHA512

2ec62a57c9de3c7aafec8e915d91264757306305b27429dc750c55753cb9a0408d835663909a69e35bebdd92747d82becc159d35c52b05c759527c6fbad78764
SSDEEP

96:z0B96BLIzEJGyfLtnMhyyB0Tjp3bEsj6aDA5LPFoTH:oEkQsgLW0S5W

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28
PID 1888 wrote to memory of 536	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ce0b6ffd35b6e5bfbd1f76a5f0d4c46bfad3b0c9a779054178e45fc2d0f97d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ce0b6ffd35b6e5bfbd1f76a5f0d4c46bfad3b0c9a779054178e45fc2d0f97d.dll,#1
  2⤵
  PID:536

memory/536-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download