76d6b80986de48ed9b08671bf69522fb5424bd016768132bd303a0c5be909d1d

Analysis

max time kernel
89s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:28

Target

76d6b80986de48ed9b08671bf69522fb5424bd016768132bd303a0c5be909d1d.dll
Size

41KB
MD5

721627dbb8d879adbae593fcff3f9628
SHA1

3b7d3e1d4f4cefd3bd8e728cd3ac9c108f743d36
SHA256

76d6b80986de48ed9b08671bf69522fb5424bd016768132bd303a0c5be909d1d
SHA512

321b3bc029b391c45049c22eb76ac6fdec2daec48e5c890049cf7f20a7d9b6cd19bae0fc9e418c9433926e275236ca751172e431b4e55d8ab61d45d2d5704982
SSDEEP

768:d61guqcmwVeMXtL+UctJfps5cnryvTH3BjivZD8tMI:agF0eiyUcbOOryvNmR2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28
PID 2020 wrote to memory of 1980	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76d6b80986de48ed9b08671bf69522fb5424bd016768132bd303a0c5be909d1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76d6b80986de48ed9b08671bf69522fb5424bd016768132bd303a0c5be909d1d.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download