99256cc36082fd50cec69211dac94c3f130ba8ec8fb771c928aeed39967eff2b

Analysis

max time kernel
13s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:39

Target

99256cc36082fd50cec69211dac94c3f130ba8ec8fb771c928aeed39967eff2b.dll
Size

7KB
MD5

07c3542fbb6cfc1e6a9ac56cfdb06890
SHA1

059cfa2a747607ccdf77d00e6a8cf8a3f2eaa857
SHA256

99256cc36082fd50cec69211dac94c3f130ba8ec8fb771c928aeed39967eff2b
SHA512

fa6e836fe8f119368121d5dc7ec9a76fbfa6a9d9ea3c676f07cc4067c43bb1bf1818e6c4ba114c574ec92814cecd912b73e59a802e3704d6fea486f5d81383f0
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROtMZqvc1rsJf/UDRsH8HYYBnunvZL:YX6MZqvcKJf/UDRsHwBnuvZg7xg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99256cc36082fd50cec69211dac94c3f130ba8ec8fb771c928aeed39967eff2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99256cc36082fd50cec69211dac94c3f130ba8ec8fb771c928aeed39967eff2b.dll,#1
  2⤵
  PID:1728

memory/1728-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download