74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91

Analysis

max time kernel
28s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:54

Target

74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll
Size

6KB
MD5

c65afb0e2465661bdc08e4aab81b6190
SHA1

0b5db9f697a55b200aa3df663cfcfd7104d0f071
SHA256

74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91
SHA512

9c8f7e72c70eb9db1d65172db131a22c02a57fb3a1ef660b1e6ca969bde7b574c719341196b4861c4fb5f6ab5c07d81e002de527cc43f1447b79c10257330497
SSDEEP

96:nEY2RrF1eqwi4occRzunyRYx7VIrhQQFqoQ+91D9So9OyAqSF:EHRh1eppWJTrAoHJk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26
PID 2000 wrote to memory of 1968	2000	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download