fc0a77e979ce4b7a23469ef2b3cf5b648161499a31fd0c9bcbcce4c591a9bec2

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:20

Target

fc0a77e979ce4b7a23469ef2b3cf5b648161499a31fd0c9bcbcce4c591a9bec2.dll
Size

16KB
MD5

c28296a4a1091193fb01dcb9f9f8f4a0
SHA1

414de89c33a84f916edae39dd72185f97e15fe30
SHA256

fc0a77e979ce4b7a23469ef2b3cf5b648161499a31fd0c9bcbcce4c591a9bec2
SHA512

58a05c27217d86e2218a9decf48301044bce1edda382c362ac0bcd0c9bdbbdfecce54c1a95ab3c32057d32900f01e4597e77e2c7f8fcc23f7b3adb72597a82df
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKt:JT0qmznB6rwUmRvRo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0a77e979ce4b7a23469ef2b3cf5b648161499a31fd0c9bcbcce4c591a9bec2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0a77e979ce4b7a23469ef2b3cf5b648161499a31fd0c9bcbcce4c591a9bec2.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1172-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download