eb89c3faba6d3967f86d1673ed292e0e9e74e0ca96eb6246040ca4af00e1d2ba

Analysis

max time kernel
6s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:07

Target

eb89c3faba6d3967f86d1673ed292e0e9e74e0ca96eb6246040ca4af00e1d2ba.dll
Size

7KB
MD5

20c5a707151133943248dac42fe7b3c0
SHA1

f934549a10d974a42a0058bc31a286076256dedf
SHA256

eb89c3faba6d3967f86d1673ed292e0e9e74e0ca96eb6246040ca4af00e1d2ba
SHA512

e2c507e38801a418a68f1e1f77524ab0fe594e86bd3226ddbd425af4d40723629dfb261701c71360c2ab1d34d0bb65214d22e1c550b30e0c17d3d506ba308229
SSDEEP

96:z0xgPtJrYmVjGwd+Ub9LQ817936Uo49f1KBv02c:nTiS+EFL1793YI1MM2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28
PID 1372 wrote to memory of 1360	1372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb89c3faba6d3967f86d1673ed292e0e9e74e0ca96eb6246040ca4af00e1d2ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb89c3faba6d3967f86d1673ed292e0e9e74e0ca96eb6246040ca4af00e1d2ba.dll,#1
  2⤵
  PID:1360

memory/1360-54-0x0000000000000000-mapping.dmp

Download
memory/1360-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download