62cd13bec9728930aa17ecf0881cc129bbd6905e2d390a6c0764f4a954f2e3e8

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:22

Target

62cd13bec9728930aa17ecf0881cc129bbd6905e2d390a6c0764f4a954f2e3e8.dll
Size

6KB
MD5

32aa8753cc6779977b7d1e8ab53f80c0
SHA1

56b650efeb166916f817dd8136c6be36622b8f00
SHA256

62cd13bec9728930aa17ecf0881cc129bbd6905e2d390a6c0764f4a954f2e3e8
SHA512

b735b7bc0adeac3500afbc339f9746d3d7e0ead39532e6f72992f157d42ee363d9ce4be9031361302633777652216095469178b14fefe62ed3aa40240cf69b7a
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvww:DixZjmjtjd8jPjcZGR5TIw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62cd13bec9728930aa17ecf0881cc129bbd6905e2d390a6c0764f4a954f2e3e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62cd13bec9728930aa17ecf0881cc129bbd6905e2d390a6c0764f4a954f2e3e8.dll,#1
  2⤵
  PID:1272

memory/1272-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download