cd063bd8d716c3b231863fc0a43f08d4b932fdb6ac80d77aae1f3bc2e38a4aad

Analysis

max time kernel
104s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 21:00

Target

cd063bd8d716c3b231863fc0a43f08d4b932fdb6ac80d77aae1f3bc2e38a4aad.dll
Size

36KB
MD5

5fe63e9367208bb78abb7b5c5d58aa03
SHA1

3e46e1ca178439657efcef8c633de0b43b29a71c
SHA256

cd063bd8d716c3b231863fc0a43f08d4b932fdb6ac80d77aae1f3bc2e38a4aad
SHA512

b1f240c929f27849fd3acdf648836b0e139a57558fbd9a01e00137af7b9d4a870852d98e0ac8206b45e99f53eacb27627298dc9b4c6fece36f7de7527880aa6f
SSDEEP

768:GU53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZlVq:pxByNbN+eqgcRF7V7YvdR0VAzI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28
PID 752 wrote to memory of 428	752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd063bd8d716c3b231863fc0a43f08d4b932fdb6ac80d77aae1f3bc2e38a4aad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd063bd8d716c3b231863fc0a43f08d4b932fdb6ac80d77aae1f3bc2e38a4aad.dll,#1
  2⤵
  PID:428

memory/428-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download