c61a72f286ff57b2c6fa95144ca0052f95f6d049e6b7d4bb9ad1c83f5a8a71ed

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:57

Target

c61a72f286ff57b2c6fa95144ca0052f95f6d049e6b7d4bb9ad1c83f5a8a71ed.dll
Size

5KB
MD5

24e56647e9c91cce5484e629ea0d0920
SHA1

a4992a45e5ddee9b8b2ee02651769fc6acc59392
SHA256

c61a72f286ff57b2c6fa95144ca0052f95f6d049e6b7d4bb9ad1c83f5a8a71ed
SHA512

f2fa98933667f2660474db10b475f731fcc60cf19ee5cd90206fb639ac71416c4c5c918959d11afbaf89d230364e615789e00c133cbfe5992181a9c338ccc575
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgsFZeWgYBy+obTyaOhWAcJNVADFA/0MdIS:nI2RrUeqXIs3ARA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c61a72f286ff57b2c6fa95144ca0052f95f6d049e6b7d4bb9ad1c83f5a8a71ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c61a72f286ff57b2c6fa95144ca0052f95f6d049e6b7d4bb9ad1c83f5a8a71ed.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download