931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:10

Target

931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll
Size

6KB
MD5

64897b0863265c9d3ddc5d07aca47020
SHA1

a7d21681914a3d620a493da14e1a75121bf46ef7
SHA256

931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f
SHA512

8a9d62e890147b740f66138f79d99e4b17a634f33a48ca02bdd501bd11cabed6a3cdb3616d2924b78383cac280f14fabdc517b16ccb3c94b3dd1e19e857d3e69
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIaASuzSTDhbEjaSbQj:unSR6bgY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download