8af40cd076681019dfe4c87437e93c745dd90c5b9d975c0622db8e88ff730568

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:05

Target

8af40cd076681019dfe4c87437e93c745dd90c5b9d975c0622db8e88ff730568.dll
Size

34KB
MD5

93b07b70ef14c69209bc4fa435beddf9
SHA1

040803335ad38f5b6dae1ad90f36aec7bea2512d
SHA256

8af40cd076681019dfe4c87437e93c745dd90c5b9d975c0622db8e88ff730568
SHA512

38f15a00cc710333d7512f3b3bab6f4a2e18505af7c6f5bb2777fe6a963e865a98ef7ea2357906059e81ec181f38d0474ddd04e756e4c68bc3fec0716d7dfba1
SSDEEP

768:/Qg1pmTl4azOpupJHNr7rOppFbOOJLd2RIoqZ:Ig1pmTlJMup7rOpDPR2RIoqZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28
PID 536 wrote to memory of 1112	536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8af40cd076681019dfe4c87437e93c745dd90c5b9d975c0622db8e88ff730568.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8af40cd076681019dfe4c87437e93c745dd90c5b9d975c0622db8e88ff730568.dll,#1
  2⤵
  PID:1112

memory/1112-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download