f4b6a812edcc0d1206a21829100bc1cf844d575f0812ac4a3d45323b9bfe25f9

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:48

Target

f4b6a812edcc0d1206a21829100bc1cf844d575f0812ac4a3d45323b9bfe25f9.dll
Size

167KB
MD5

d9463d7471a4b9609e5bd6bff9bd0978
SHA1

6e8969007e34d81ca1dea0370801263c87a61507
SHA256

f4b6a812edcc0d1206a21829100bc1cf844d575f0812ac4a3d45323b9bfe25f9
SHA512

7944b6645f45e991af4e46cd79a4b2d315e13646e956e685563f56f02ad65a1024173642429d0339194f81f0e084ae07c7b7b4c30a35b2dbee34868afe8e2c6d
SSDEEP

3072:AgVYaxvfGuTMCdljREfiNSi5TN2KHPlHx2Xn:AgVY4fF4CdljREY5TXHlMX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b6a812edcc0d1206a21829100bc1cf844d575f0812ac4a3d45323b9bfe25f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b6a812edcc0d1206a21829100bc1cf844d575f0812ac4a3d45323b9bfe25f9.dll,#1
  2⤵
  PID:2016

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download