dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e

Analysis

max time kernel
48s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:45

Target

dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll
Size

6KB
MD5

39aab0e304e68aed03def10a85460dc0
SHA1

0860dbf970d1a56a693ce0ba0604c91235832c28
SHA256

dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e
SHA512

208fcdc06581a4c9d0f37d89080c17b1ce5fd37688a3d75e02aac8339ee82deee0898bb67137ec7fac21a557f712331e2e52ad1def44cfe9ff0051f5f79baae8
SSDEEP

96:nEY2RrF1eqwi4aRldkyp4S0LJNE4tMrUC18:EHRh1epptaOs4EUO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26
PID 1752 wrote to memory of 1812	1752	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll,#1
  2⤵
  PID:1812

memory/1812-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download