c77930e6a99b46e9049c78f54aff0afa5208de03770b028334cdf82195dc0694

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:36

Target

c77930e6a99b46e9049c78f54aff0afa5208de03770b028334cdf82195dc0694.dll
Size

18KB
MD5

f2f441e21b0bccdc07cae241b63828ba
SHA1

3f36f33fd5aa987011778c53b9ee77a774dd7732
SHA256

c77930e6a99b46e9049c78f54aff0afa5208de03770b028334cdf82195dc0694
SHA512

1775273fbbfab1ad121b923a3ea488afa95282a91b47f078283509bbcc02eefb04d48aa27d45876cc71c0871069be647e35f67a638ac8f3dbfdec61d49c92aea
SSDEEP

384:sNRdCyDzMqlWemQiDd+fE3yJRUh0uDvAzi7v:ICysql/mQokJRKXM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c77930e6a99b46e9049c78f54aff0afa5208de03770b028334cdf82195dc0694.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c77930e6a99b46e9049c78f54aff0afa5208de03770b028334cdf82195dc0694.dll,#1
  2⤵
  PID:1932

memory/1932-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download