6e0c6e4acca98ebcf9b17e45baceb066da145b44a74266402864f3003344a044

Analysis

max time kernel
40s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:36

Target

6e0c6e4acca98ebcf9b17e45baceb066da145b44a74266402864f3003344a044.dll
Size

6KB
MD5

c7017ea324e7d69ca0372dfd3e1b91a0
SHA1

ba9520f34e130aa9912c246d1b7886a76477a19b
SHA256

6e0c6e4acca98ebcf9b17e45baceb066da145b44a74266402864f3003344a044
SHA512

506633d80e7b6e43190fc1612affa8f67825e8865a47c5d98186e50df16295b227ea319f90b25b56ad984e6ace98ff9a2b0060a76a93194a6bf7c9c831ff0d4f
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7GNpZ:nGTWJGp0UZUd6378snt7U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28
PID 896 wrote to memory of 1088	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e0c6e4acca98ebcf9b17e45baceb066da145b44a74266402864f3003344a044.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e0c6e4acca98ebcf9b17e45baceb066da145b44a74266402864f3003344a044.dll,#1
  2⤵
  PID:1088

memory/1088-54-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download