eb8deacd709c6486fc4812091d1f8125a1106e390279b2704d489004875df174

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:00

Target

eb8deacd709c6486fc4812091d1f8125a1106e390279b2704d489004875df174.dll
Size

36KB
MD5

e58e8c8b421617423e2029d072c92543
SHA1

3f69c4f24f5bae5a264ac2f93fc3902e10a10c9d
SHA256

eb8deacd709c6486fc4812091d1f8125a1106e390279b2704d489004875df174
SHA512

586510e5d660bd571f5a729941964c8c78364ba97f02c3c41a01bbf8460e1b12652dd1bd6ba63b11333660f9b9821e4433a601a95ef99846e7cbad4d0063d878
SSDEEP

768:Gv53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZlVq:UxByNbN+eqgcRF7V7YvdR0VAzI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28
PID 1916 wrote to memory of 1376	1916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb8deacd709c6486fc4812091d1f8125a1106e390279b2704d489004875df174.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb8deacd709c6486fc4812091d1f8125a1106e390279b2704d489004875df174.dll,#1
  2⤵
  PID:1376

memory/1376-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download