7fa1df458ee392c639d1933cc9430f61553cdbd28a6d1f574840af38142966fa

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:50

Target

7fa1df458ee392c639d1933cc9430f61553cdbd28a6d1f574840af38142966fa.dll
Size

4KB
MD5

3335007cd0cd0e4becf59196567da000
SHA1

4ee57e8efd59af9e7bc53ef48601c72a89899836
SHA256

7fa1df458ee392c639d1933cc9430f61553cdbd28a6d1f574840af38142966fa
SHA512

23b918e743506e5c90fac8199a8f2d1726611f8598992194a5869ba7e72030d3e42771745a1023788f8718c71b49da06b5513a3cc4d65d19231576e5ef57dec3
SSDEEP

48:qHupGeMcCB96DrhWHR0FiIsipZlM+u+eAPMDQHpyuLv6omZoMF:PMXB0rw0MI/pwbdf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28
PID 2004 wrote to memory of 1980	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fa1df458ee392c639d1933cc9430f61553cdbd28a6d1f574840af38142966fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fa1df458ee392c639d1933cc9430f61553cdbd28a6d1f574840af38142966fa.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download