c2b041e0bb8bd367c20fc3025feb6ddea4edd97c7c6207c14a2dbc373e90d0cc

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:24

Target

c2b041e0bb8bd367c20fc3025feb6ddea4edd97c7c6207c14a2dbc373e90d0cc.dll
Size

4KB
MD5

0381616718c67e8951a873629c01cfd0
SHA1

28da7ac76c7030a6f0417e9ac99b141c2e0b90f7
SHA256

c2b041e0bb8bd367c20fc3025feb6ddea4edd97c7c6207c14a2dbc373e90d0cc
SHA512

baaf4298a5e7939af0fd42884e15f2ddb6e7fe0c1859b5c256b35b049ddd97ea93b9d4b39bd9313ee796e161d65d208ba02c62af2b2381fd1106d12e2d22b338
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKRpOI48sLolhjfeB0/waSxNXK1Q43nVO0:PT3r2vu9MtLZlFeB01S2nw0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2b041e0bb8bd367c20fc3025feb6ddea4edd97c7c6207c14a2dbc373e90d0cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2b041e0bb8bd367c20fc3025feb6ddea4edd97c7c6207c14a2dbc373e90d0cc.dll,#1
  2⤵
  PID:944

memory/944-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download