b6e8ad7565bd97b3b453a4fefc8f110735f8493997445feafe795a95e919dcd6

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:01

Target

b6e8ad7565bd97b3b453a4fefc8f110735f8493997445feafe795a95e919dcd6.dll
Size

6KB
MD5

5fd7c2234c56ed5780b7dea5c03f7ee0
SHA1

9d838407ce807f105607dfcaf7cd4b8fb6e7cff9
SHA256

b6e8ad7565bd97b3b453a4fefc8f110735f8493997445feafe795a95e919dcd6
SHA512

b229d63bb741f587294ce776a1c9b7c2a7551a303fef325cc6584bc28f7b132133370d341fd0a25c9727f2152afbfa235c3a2a87e1849120992fd22db72a4c09
SSDEEP

96:hy859x0P8MaQcKUsehbhiIcAeABEJ9MYHHSB:F5oLNGNhbUvDABu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27
PID 1368 wrote to memory of 1700	1368	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e8ad7565bd97b3b453a4fefc8f110735f8493997445feafe795a95e919dcd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e8ad7565bd97b3b453a4fefc8f110735f8493997445feafe795a95e919dcd6.dll,#1
  2⤵
  PID:1700

memory/1700-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download