9efea7b0a1723a865ac8f56ec30badb1a486bfd3c45ff1c77090f2459b760944

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 17:51

Target

9efea7b0a1723a865ac8f56ec30badb1a486bfd3c45ff1c77090f2459b760944.dll
Size

13KB
MD5

6bdecd94fa56ad978bd08af78363441c
SHA1

0bf91b9743be551bb5d00583491ebf96750e6a86
SHA256

9efea7b0a1723a865ac8f56ec30badb1a486bfd3c45ff1c77090f2459b760944
SHA512

d7115398af3aaea241b473b1a95c2334e0a1332fc7299430d4dc4a069ee9c557001a189f160c085997401ecb100458a022720ad6bd16b5b13a7ec438f908780b
SSDEEP

192:Upe6W9zjWyoWfXmu3cVPnk7O5/2IRnad5jNQIbp+I7kgUwu:qe6W9zjW2Pm4N7O5JRnad5jNQeBk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28
PID 1088 wrote to memory of 1780	1088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9efea7b0a1723a865ac8f56ec30badb1a486bfd3c45ff1c77090f2459b760944.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9efea7b0a1723a865ac8f56ec30badb1a486bfd3c45ff1c77090f2459b760944.dll,#1
  2⤵
  PID:1780

memory/1780-54-0x0000000000000000-mapping.dmp

Download
memory/1780-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1780-56-0x000000005A0E0000-0x000000005A0F3000-memory.dmp

Filesize
76KB

Download