2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 19:33

Target

2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll
Size

57KB
MD5

d2855946048267836ee162a97db49e60
SHA1

cb31ebdc76f9ed0924149f74a27187ede1928e6c
SHA256

2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7
SHA512

2d5bc9136bdf66fca95649d5b6c6238c636a51a00a92492bb2f98916600b778cedefae4baa84dcd9b60fa329c43867d447fd5326287d44c9a120b70f8618e4e9
SSDEEP

1536:e6PViKuLJqOf7WxUDF9OciPINW2inKzsBj:RViKuMOftZ95iQNWZsU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28
PID 2028 wrote to memory of 1888	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll,#1
  2⤵
  PID:1888

memory/1888-54-0x0000000000000000-mapping.dmp

Download
memory/1888-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download