664be007532517d76bb9b16771f93ca46d010e9fc00def45674a278350ff8d90

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:21

Target

664be007532517d76bb9b16771f93ca46d010e9fc00def45674a278350ff8d90.dll
Size

4KB
MD5

cc548f466d4313eb094f77b298618e40
SHA1

7d789d07f9dd3048ee39e361ddfde2397d58c085
SHA256

664be007532517d76bb9b16771f93ca46d010e9fc00def45674a278350ff8d90
SHA512

715f5edd9e926b601355bca8318b3b06291c5fafddb93cc1db9a817505d0d52c956797bdcb4e5d8012ad9331aa19f33f440ed33ff6c07cfae5db4404f42cbf00
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LAT1D0x0f/x/qjapK8t+VoxDTWvNCDnae:TRphMzf8M1Dzcap6WSVonb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\664be007532517d76bb9b16771f93ca46d010e9fc00def45674a278350ff8d90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\664be007532517d76bb9b16771f93ca46d010e9fc00def45674a278350ff8d90.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download