6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:20

Target

6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll
Size

7KB
MD5

30b5967e20427091392c2b3ba32c17c0
SHA1

a9b3abade24e4bcd3d8684a61a7a39f6ec80488f
SHA256

6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23
SHA512

1fd6680d73f51a9f50882665474211854b4ed1489e2370bfdfa8c9e157b6036f847249625df949782a8789dd46bd5c3e81b88117aebb3b496ef9f0518027c219
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4sr+x4cEhvyyFUitDVJU0A1yjM0n9F:2M/SdjbgYj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll,#1
  2⤵
  PID:1620

memory/1620-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download