961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e

Analysis

max time kernel
6s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:40

Target

961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll
Size

4KB
MD5

3ee025b441833486450f53e143a8d300
SHA1

afc95db0d758acb5c43a1d505df856f7ffedef3e
SHA256

961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e
SHA512

240114f84b0312a67548ab6220600a4c1850ee7ff275c064b7f6e79117c2133376cf79d1ea815a4df0b8a156ae5e00a53d00121782a5166efa3420e4c308f30f
SSDEEP

48:SWkO0IoyTnXz+ihZjokbnZCyW2PH8kTvJ:ZJTnXzvokVCyWtkTR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll,#1
  2⤵
  PID:1508

memory/1508-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download