81061d8db5888578adbcb6ba9997c11aaf8fca697fe4170dc6379eafbdb10e27

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:14

Target

81061d8db5888578adbcb6ba9997c11aaf8fca697fe4170dc6379eafbdb10e27.dll
Size

5KB
MD5

bf285b46dfdeefe0cdaa371ce207b490
SHA1

eac33a07645ad3d6653e651a75224e319c260d9f
SHA256

81061d8db5888578adbcb6ba9997c11aaf8fca697fe4170dc6379eafbdb10e27
SHA512

f5ce1d03a02f54d3b558f0885cda26cce777be174f470cc82f447fc675368e634075eb83018408d8aa969ab6d967bd5505d2b24b3e1bcdb5d469ab2d5075ac29
SSDEEP

48:SWkO0IoyTnXz+ihZjokiNtf8DQngv1Z1jFL+vHTcmc8dTBY26pH6As:ZJTnXzvokiQD86ZpxCHTDZddY2a63

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81061d8db5888578adbcb6ba9997c11aaf8fca697fe4170dc6379eafbdb10e27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81061d8db5888578adbcb6ba9997c11aaf8fca697fe4170dc6379eafbdb10e27.dll,#1
  2⤵
  PID:1848

memory/1848-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download