abf639c767139731ba0731502fd5e827b8ab819b62d68445c61803e2e5d1d727

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:32

Target

abf639c767139731ba0731502fd5e827b8ab819b62d68445c61803e2e5d1d727.dll
Size

4KB
MD5

fe86080dff95229d135893250ff8a550
SHA1

04ae29bb86ea65ae9b42c7c09b47f44bdafbdb81
SHA256

abf639c767139731ba0731502fd5e827b8ab819b62d68445c61803e2e5d1d727
SHA512

d328045b62d5a9dc777eb48170f0cc061af861f97fe23b0e4b0a0ab72871a8c44c9bef44f13952a9c901534a7ab8577663b6f72da9426647962ce5aaf7eb7dbb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LsmgT3eX/bK1WphB3s5uW7ZFKCIsuvc9+:TRphMzf8AOX/bK8htGvZFKCg09+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abf639c767139731ba0731502fd5e827b8ab819b62d68445c61803e2e5d1d727.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abf639c767139731ba0731502fd5e827b8ab819b62d68445c61803e2e5d1d727.dll,#1
  2⤵
  PID:1612

memory/1612-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download