0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:20

Target

0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll
Size

7KB
MD5

4ae28dd0f95defa17bfa9cb12d065af0
SHA1

dcab46df7103900b10892e2c2da1f714ef7cc40d
SHA256

0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7
SHA512

10510989060113ac2bfda7cf0d8a70cc23be769c325cb83271e504e97c7756524fb1d657bf970009113aa418c77941f9aa7d4e73e07d01b005446a10d03feb01
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4ClRBubnQNs6CWvjzJxUeNzktFHin4:2M/SdjbgY3BubnCBUeNotFH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28
PID 1724 wrote to memory of 980	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll,#1
  2⤵
  PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download