700e2c67d7f3be7c78395db83187444e54390ebbad8c4641ac01153a13b796ed

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:56

Target

700e2c67d7f3be7c78395db83187444e54390ebbad8c4641ac01153a13b796ed.dll
Size

5KB
MD5

3ba117d5c488913e7e71b005a03a3440
SHA1

0cbb6732fc9a838a3df908135f4b624298e9d1a2
SHA256

700e2c67d7f3be7c78395db83187444e54390ebbad8c4641ac01153a13b796ed
SHA512

f3f9e6c2328856111946a0d9813f6d24bf877d274252b983016ae7c798321331531b72a039da3de6f26f4be231c65ad3b9b0273b3601e7f72f88679bad08f796
SSDEEP

96:z0/gPtJrYmVjGwd+8blPDDDDDDDDEZSiCr:FTiS+siZdM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28
PID 1188 wrote to memory of 1120	1188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\700e2c67d7f3be7c78395db83187444e54390ebbad8c4641ac01153a13b796ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\700e2c67d7f3be7c78395db83187444e54390ebbad8c4641ac01153a13b796ed.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download