c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:24

Target

c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll
Size

40KB
MD5

3cfd70d234399fd7d5bf4bc9c489bacc
SHA1

a0fc25c70cfd490e605e0f438e8ad6ae5dc35e47
SHA256

c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372
SHA512

30bcdc60364c9b036abaaa9f3297669e5f37826d920d9213055f9448317b5349396580a9b3c98e8d4190040ed66c6161f991af93d56e4cbb492ff6a4508b8fee
SSDEEP

768:fJin9YHEco5yOr9iUHrkHz4sSVETg7yff9Iuzuen+:fJi0QyO5zezXZTg7yH9Qe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27
PID 960 wrote to memory of 1476	960	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll,#1
  2⤵
  PID:1476

memory/1476-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download