6ee1c9cf8cddaf9b387836f57974c77240a5f2c51c1fc1a904e2ff57ac8527a4

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:33

Target

6ee1c9cf8cddaf9b387836f57974c77240a5f2c51c1fc1a904e2ff57ac8527a4.dll
Size

62KB
MD5

41bee7c76663805eebde62f0b59570d2
SHA1

8073013d4b3d633a760259ceec66fa4aaf847601
SHA256

6ee1c9cf8cddaf9b387836f57974c77240a5f2c51c1fc1a904e2ff57ac8527a4
SHA512

8ec6b462f23dc1c1ea9580c053ca3d489cb1782cc071a016d60e3de84857f9172d134780f46715fcf00387ae99a83046befa3decb04f1d8bd068f3ab50cb5c2a
SSDEEP

1536:Cn5P0l70x5CJpVffYgaEcEIIUOjweIF2acw9k:w5s70x4JpVnYGcEIItweIFSQk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee1c9cf8cddaf9b387836f57974c77240a5f2c51c1fc1a904e2ff57ac8527a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee1c9cf8cddaf9b387836f57974c77240a5f2c51c1fc1a904e2ff57ac8527a4.dll,#1
  2⤵
  PID:1080

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download