260f8af83d327b8802cb78ddd6a6f48157635da94fbe84ae8bad2573b04a4ca1

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:05

Target

260f8af83d327b8802cb78ddd6a6f48157635da94fbe84ae8bad2573b04a4ca1.dll
Size

33KB
MD5

58e16a0105594a54d0478618af438920
SHA1

5940a97ef19562844e1dd53922da6228499c3dc3
SHA256

260f8af83d327b8802cb78ddd6a6f48157635da94fbe84ae8bad2573b04a4ca1
SHA512

033b56246e786853a4eda6c2c54937a06ed94b5f0892790b9c38c41a459cba9683114db5d234bf763f57c151994fec92d878984c7d4ec31cdc05bc3936dd3b7f
SSDEEP

768:RrJbY4tHwgO2ZaYS633jn7gqbMB7cO6sERUAaj5:FJbY4tHnaYBnD7gqbnkERUj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\260f8af83d327b8802cb78ddd6a6f48157635da94fbe84ae8bad2573b04a4ca1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\260f8af83d327b8802cb78ddd6a6f48157635da94fbe84ae8bad2573b04a4ca1.dll,#1
  2⤵
  PID:1852

memory/1852-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download