ee86b7cbea994634a152f1c288fd67a5abb0052eddec24e29ef3a0c5bf86bee7

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:24

Target

ee86b7cbea994634a152f1c288fd67a5abb0052eddec24e29ef3a0c5bf86bee7.dll
Size

6KB
MD5

96467809c47a97a8cc15df768a795420
SHA1

08fdd1a6972a3c4e8f56c4a9d29e4c23e6c49a5a
SHA256

ee86b7cbea994634a152f1c288fd67a5abb0052eddec24e29ef3a0c5bf86bee7
SHA512

d0884c6efff66e8010bbc391cecf58dc3a3e24bad43099ef1acd19aa78fb7b0c520397fe0e643237eb46aeeab21121b1e85af3efc549a16caf5efd675a41638a
SSDEEP

96:FtrRdrY0x7+PZMm67YGWoawJdvvz9/uM9jDdh:Ft11+PaZVawJn2M9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee86b7cbea994634a152f1c288fd67a5abb0052eddec24e29ef3a0c5bf86bee7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee86b7cbea994634a152f1c288fd67a5abb0052eddec24e29ef3a0c5bf86bee7.dll,#1
  2⤵
  PID:1700

memory/1700-54-0x0000000000000000-mapping.dmp

Download
memory/1700-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download