a7f05b4ac95176344acbf369c5d0fb904b455e6f4ece6a2f9aa7fe73dc2cabc0

Analysis

max time kernel
57s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:50

Target

a7f05b4ac95176344acbf369c5d0fb904b455e6f4ece6a2f9aa7fe73dc2cabc0.dll
Size

5KB
MD5

31221f1a89d9aaee7dce046adb8d51f0
SHA1

ffdc2d609f22cfb750f3d36eccb663372025afc1
SHA256

a7f05b4ac95176344acbf369c5d0fb904b455e6f4ece6a2f9aa7fe73dc2cabc0
SHA512

465de5c2edc02989ac3d57077bb3c17c2509c909da687e297750cf230d4b000619d0b2aa13881365a3e77012c830946780810821a14d05701d919af49128d82a
SSDEEP

96:nEY2RrF1eqwi477d5wV+m/YAlHLKmBEJKZ6v9/UbnypK+2s2:EHRh1eppLwV+mYgBEJKEebMK+6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28
PID 1980 wrote to memory of 1504	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7f05b4ac95176344acbf369c5d0fb904b455e6f4ece6a2f9aa7fe73dc2cabc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7f05b4ac95176344acbf369c5d0fb904b455e6f4ece6a2f9aa7fe73dc2cabc0.dll,#1
  2⤵
  PID:1504

memory/1504-55-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download