c86dbb6b47a4b5ec2f8712f82b9edf2516a1bfefccc38ab600e15d2431178714

Analysis

max time kernel
27s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:25

Target

c86dbb6b47a4b5ec2f8712f82b9edf2516a1bfefccc38ab600e15d2431178714.dll
Size

46KB
MD5

5b356619790264c633227b2159803331
SHA1

42827d89b8c445b8162dd4ce467387a4e4da8504
SHA256

c86dbb6b47a4b5ec2f8712f82b9edf2516a1bfefccc38ab600e15d2431178714
SHA512

b2121d3bdf88c9585dfc0926c7a344c229fa085fb70576fc70646d29bdbf69c4db5713efa9de51ee67ae7e741317cab530ddea9b13d959ea1edda3c1385815db
SSDEEP

768:/um3QOB2zRkEV0qApVNV0gTGth7GCV0/i0OecXHdchcBLWRcGGfpbUKWOIWSG:mPO6KEVbsVP0g6t5qYHiWWRcGbyV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28
PID 1956 wrote to memory of 2028	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c86dbb6b47a4b5ec2f8712f82b9edf2516a1bfefccc38ab600e15d2431178714.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c86dbb6b47a4b5ec2f8712f82b9edf2516a1bfefccc38ab600e15d2431178714.dll,#1
  2⤵
  PID:2028

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download