4bad964d1740e9299dbbd603525ac5f8ec0e8e3b05c10125ccab3f3290fc00c9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:57

Target

4bad964d1740e9299dbbd603525ac5f8ec0e8e3b05c10125ccab3f3290fc00c9.dll
Size

6KB
MD5

ada9cf3393787ac29ffea94c4defb710
SHA1

1be7078d79b2ce483bb70d408ae600136668f204
SHA256

4bad964d1740e9299dbbd603525ac5f8ec0e8e3b05c10125ccab3f3290fc00c9
SHA512

6959f59a63afe17032276822f4dbb519107f2f3d430a12a8660865353a82fedd6f96786de0ed3de15bddbc90aedbf29d438b9e3e0f4919cf97732475da9824c4
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhVFDsIgTLDjoxs50tZb3iAi4Pcan:nEY2RrF1eqwi45AICN5WbDyGEIai

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bad964d1740e9299dbbd603525ac5f8ec0e8e3b05c10125ccab3f3290fc00c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bad964d1740e9299dbbd603525ac5f8ec0e8e3b05c10125ccab3f3290fc00c9.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download