f858c254043bb0e67129ac0fd3405160c2ed45b6b0f75a4e4954296c4a386172

Analysis

max time kernel
35s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:03

Target

f858c254043bb0e67129ac0fd3405160c2ed45b6b0f75a4e4954296c4a386172.dll
Size

6KB
MD5

90b739db1a2166fc7195e3597aaeb7a0
SHA1

0d1c04e9e146c7def93bf27bbcd7fdce2d79f400
SHA256

f858c254043bb0e67129ac0fd3405160c2ed45b6b0f75a4e4954296c4a386172
SHA512

13515f8d9dad981b4b543ed6f7d955603abf4ea2abf3006468ed5a3574e70325f3e2ac8b10f041f327e1c6469e15755d01e812ef58b80f79474e5134cfb64ace
SSDEEP

96:nI2RrUeqsOKDmSdFOlqTJvxg/MJyxwPSZtG0eo:XR4e7ZmIlJDSZt9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f858c254043bb0e67129ac0fd3405160c2ed45b6b0f75a4e4954296c4a386172.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f858c254043bb0e67129ac0fd3405160c2ed45b6b0f75a4e4954296c4a386172.dll,#1
  2⤵
  PID:1260

memory/1260-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download