6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:26

Target

6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll
Size

6KB
MD5

56d4e1c3ac239ab4f14ef226bd2e2700
SHA1

dbda6e756242709880b2029b2b55cb1227bd7a8c
SHA256

6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a
SHA512

e610b4267cdcb15108ed83b52079cab579668fb0b346432c69d5e9f33d8923405a04b454f21089f82108ad62981216fbde1253822829cb3bfb84bf49b35a8ccb
SSDEEP

192:Ft11+PANORH+kXbVJN2WqewcH2njc9FCTpHIJFAlLbR:Fb04NORH+kXbVJN2WqewcH2jc9FCTpH3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll,#1
  2⤵
  PID:940

memory/940-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download