f3b934aa14159ba6242eeacae488b7f41ee2c64db15f65ebc84dbb5c18c9e699

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:04

Target

f3b934aa14159ba6242eeacae488b7f41ee2c64db15f65ebc84dbb5c18c9e699.dll
Size

6KB
MD5

14d17d72ba16fb0ea1796f82c0823be0
SHA1

1c1e74497ebef9fbddc6218a41c11c1ac825e182
SHA256

f3b934aa14159ba6242eeacae488b7f41ee2c64db15f65ebc84dbb5c18c9e699
SHA512

70f517a6f2c58b6a84e014314a7d9490faa6b1769cdceca2e19cd0acfc792a4e062091420457045f2423163acc654c73a008aa77722cc3b665cc6db3997b7b0a
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9Mg9qZpIFJEmIGFZJeJNSxBcwrIJ5IETJDAJqIl:nI2RrUeqh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3b934aa14159ba6242eeacae488b7f41ee2c64db15f65ebc84dbb5c18c9e699.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3b934aa14159ba6242eeacae488b7f41ee2c64db15f65ebc84dbb5c18c9e699.dll,#1
  2⤵
  PID:1128

memory/1128-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download