af30697fab0f4a4844f125012e680d4f1358c5ea22e97092eaf6c631cbcd135c

Analysis

max time kernel
31s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:53

Target

af30697fab0f4a4844f125012e680d4f1358c5ea22e97092eaf6c631cbcd135c.dll
Size

66KB
MD5

f38480f5b2f9f5bcad6286731aaeae60
SHA1

75653e9bf9d3dac7193ad908b7e47caf98cd7b01
SHA256

af30697fab0f4a4844f125012e680d4f1358c5ea22e97092eaf6c631cbcd135c
SHA512

2cabbb7f11ecb4474bb903a14507e2b5fcc8eeb94d84957dd197728222cc1be723d3b1f2cf6a6c3924e4bff1e4b7081b9ed54601f27790e442a1ae8ec82d2ced
SSDEEP

768:GbvLDaaMact8TADbccELospd5qexsuaUsdeZegqoWIei4K7j4dUlR2UAK/qSPQl+:evqccIoEd5qvuvsMtpp4yR2Lrg0sOvCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28
PID 1380 wrote to memory of 944	1380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af30697fab0f4a4844f125012e680d4f1358c5ea22e97092eaf6c631cbcd135c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af30697fab0f4a4844f125012e680d4f1358c5ea22e97092eaf6c631cbcd135c.dll,#1
  2⤵
  PID:944

memory/944-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download