4209dfc57fa1e98c846ede6bd68d48f2e5493084ca5dbeed4fad1d5f258deb29

Analysis

max time kernel
32s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:09

Target

4209dfc57fa1e98c846ede6bd68d48f2e5493084ca5dbeed4fad1d5f258deb29.dll
Size

57KB
MD5

6ba8bd88119393c9b32a3b8ba45565d9
SHA1

03dfe3fbcf395562c368df74d5b2a2d64696c571
SHA256

4209dfc57fa1e98c846ede6bd68d48f2e5493084ca5dbeed4fad1d5f258deb29
SHA512

c0b7d540a3baa2717fa8f43798ac822046909bbf2630477a9ab26a7f575920924675d2b6f58bf9f7aa32aabfa4c60e254e733b0503adb44dffb2335cc5e1a2d5
SSDEEP

1536:n7ZLNPp9pZBMhWIiqLIckKRxJjV5GoxEWzKswZv90O:7ZppMWt7IvijswZN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4209dfc57fa1e98c846ede6bd68d48f2e5493084ca5dbeed4fad1d5f258deb29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4209dfc57fa1e98c846ede6bd68d48f2e5493084ca5dbeed4fad1d5f258deb29.dll,#1
  2⤵
  PID:788

memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download