ff106c5ca962f83e3fa762f6a1857be70651b311bb3702e78fd380fe5819130b

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 04:27

Target

ff106c5ca962f83e3fa762f6a1857be70651b311bb3702e78fd380fe5819130b.dll
Size

32KB
MD5

5ad7df777956c7a9d0579857cdc06cb9
SHA1

e65e8ad53b4d060d94435c945b03b59e65bd9767
SHA256

ff106c5ca962f83e3fa762f6a1857be70651b311bb3702e78fd380fe5819130b
SHA512

85597f64367e73198973ceaaf72d66e718f148c37431de1c8bd6af62a9ad84673c8db347f591b0834d9608c7ab6f0dfc01c346e8e07fb22457669d6a165831fe
SSDEEP

384:fpuj39NfuKDQ/BFgbpoVCl8zjOvyzJW77+1O+qXSQG9aFJFrRCRNYY4p:xujru/O2Ml8zCSW7ADMSZ96BURNYYk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff106c5ca962f83e3fa762f6a1857be70651b311bb3702e78fd380fe5819130b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff106c5ca962f83e3fa762f6a1857be70651b311bb3702e78fd380fe5819130b.dll,#1
  2⤵
  PID:1536

memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download