ee9525a92f8333d205bc9d97db74789c4ce6c756ee9fc78d517f7b4f2ff58c6a

Analysis

max time kernel
67s
max time network
71s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:04

Target

ee9525a92f8333d205bc9d97db74789c4ce6c756ee9fc78d517f7b4f2ff58c6a.dll
Size

34KB
MD5

f98f35b34970da39f6db03d28b4ef940
SHA1

124b7b04ffa51dd874839da40c187b48fdea10bd
SHA256

ee9525a92f8333d205bc9d97db74789c4ce6c756ee9fc78d517f7b4f2ff58c6a
SHA512

87705b8679b920ecfe750685df0e41c3a08a4f901a3f647bcdd38ed47054fff4d31f6782250433ab339207cd20b0997632a189f7768c4cf6ca69badfb1d17de6
SSDEEP

192:Wxwi1TFuE6r4Ury3OJ/3tKVOBu3kZOmE8U7BBdpMPFhNBbH+a1U21:pi1TF36rPAg/2OBuNnLaFtrv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28
PID 944 wrote to memory of 940	944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee9525a92f8333d205bc9d97db74789c4ce6c756ee9fc78d517f7b4f2ff58c6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee9525a92f8333d205bc9d97db74789c4ce6c756ee9fc78d517f7b4f2ff58c6a.dll,#1
  2⤵
  PID:940

memory/940-54-0x0000000000000000-mapping.dmp

Download
memory/940-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download