648b2a8fa98bbc287f84c4a5e69c4898dd584daaa8f38d2781b695a47e8df2a5

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:21

Target

648b2a8fa98bbc287f84c4a5e69c4898dd584daaa8f38d2781b695a47e8df2a5.dll
Size

5KB
MD5

05ffd6c5e2cb7a7edec920a77f2ac130
SHA1

1951bfae05c5e189a06cd88dd7b711806ce2a932
SHA256

648b2a8fa98bbc287f84c4a5e69c4898dd584daaa8f38d2781b695a47e8df2a5
SHA512

07dd25fabcfd8925b7e036a269528bc1748e283ca204abda3a112c4b095677d8409a15e4788ab4aa62e1d9fb10751545707bb63178082a535ddaab27f607ad31
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgD2Jy+P1HzbJBbmOmyHP2M5s6XEmzmmmmmmmv:nI2RrUeqgJyQT+yRsxj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\648b2a8fa98bbc287f84c4a5e69c4898dd584daaa8f38d2781b695a47e8df2a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\648b2a8fa98bbc287f84c4a5e69c4898dd584daaa8f38d2781b695a47e8df2a5.dll,#1
  2⤵
  PID:944

memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download