9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:51

Target

9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll
Size

6KB
MD5

f6a33d6d502f097c660b42d5809fffa0
SHA1

4f8fdd6e1b26778b007378eb43f731e84ce0f1d9
SHA256

9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5
SHA512

c195c92a02e6d7ad7ef4b5bbe1b7a4405c0db22cbe8b95049ebb63cde7d4f0a8baf2b9a68a1666ba92a414706d2b072015c68d22198452560ecdb08fab4d23a5
SSDEEP

96:nEY2RrF1eqwi42b0nr47hMD74RIbkZHB:EHRh1eppVkIuH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28
PID 840 wrote to memory of 1308	840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll,#1
  2⤵
  PID:1308

memory/1308-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download