af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd

Analysis

max time kernel
235s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:45

Target

af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll
Size

20KB
MD5

55d308f64c57e382583eb18757abd535
SHA1

6651f5b570b57e4998c2bfe042732b7e59e20914
SHA256

af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd
SHA512

ed2fb62c2b2dc5c29bd5a02356657ba05569241fc19b2892b887a1b6e2fc2708a1b5fecd7552dce31e377c6b67a40002206ec229574906172d0acf57826e90f3
SSDEEP

384:3i5lOwy/HmXfNsU4WqTRsUzlkY1O5JpJgLa0MpFA:hT/HmXf6fRsUzmtLgLa1o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll,#1
  2⤵
  PID:580

memory/580-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download