6053ef2476251f71c1ee1621861101febdc4d9ccb1b4e580fa55d0ff9b593a81

Analysis

max time kernel
4s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:37

Target

6053ef2476251f71c1ee1621861101febdc4d9ccb1b4e580fa55d0ff9b593a81.dll
Size

6KB
MD5

a76e27b505e1d24342b7e1602dd35260
SHA1

85dd8427bd5b51f94f56252f6ac06dc1a8c0f8bb
SHA256

6053ef2476251f71c1ee1621861101febdc4d9ccb1b4e580fa55d0ff9b593a81
SHA512

b7cee688418411f6630e3c5904d587cc234448e6c5cbca994dea3903858d80164b2c382f7fe7216138a6b3a3dbdac87a94b1ae293488189158ab4d1e0069f3ed
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7Jx7gpuw:nGTWJGp0UZUd6378snt7/7gpuw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6053ef2476251f71c1ee1621861101febdc4d9ccb1b4e580fa55d0ff9b593a81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6053ef2476251f71c1ee1621861101febdc4d9ccb1b4e580fa55d0ff9b593a81.dll,#1
  2⤵
  PID:1736

memory/1736-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download