022fe38fabf65c63382932eb48ec10d859bec8afcb21d0e3d2417917a29ae3b0

Analysis

max time kernel
96s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:22

Target

022fe38fabf65c63382932eb48ec10d859bec8afcb21d0e3d2417917a29ae3b0.dll
Size

4KB
MD5

f6ddf62a83bd23fa62f3f208655bd2c0
SHA1

5b3f6c296a5673f4f69d7b8afaf33ec10cb365d3
SHA256

022fe38fabf65c63382932eb48ec10d859bec8afcb21d0e3d2417917a29ae3b0
SHA512

6ff5facc3f33f9dd7433ddedd9c3731a434de80010908308d24f0c44c6feba9486dd647c145c7a58fca47b710c2935fc7e30074d31556fd1e8342c880f32c964
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LNORt0fd0DQiOxo8ZaucZONFo:TRphMzf8NSYd0Dh+cZONq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28
PID 1388 wrote to memory of 1516	1388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\022fe38fabf65c63382932eb48ec10d859bec8afcb21d0e3d2417917a29ae3b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\022fe38fabf65c63382932eb48ec10d859bec8afcb21d0e3d2417917a29ae3b0.dll,#1
  2⤵
  PID:1516

memory/1516-54-0x0000000000000000-mapping.dmp

Download
memory/1516-55-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download