ccef59f2204598ee5124caabe1b1cddfed6d3ddf2e2244be4520a2efdcfea74a

Analysis

max time kernel
23s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:48

Target

ccef59f2204598ee5124caabe1b1cddfed6d3ddf2e2244be4520a2efdcfea74a.dll
Size

77KB
MD5

463cf383b851e732b6059d28e5889058
SHA1

044e636ce90d369394240576de2f0349d9265012
SHA256

ccef59f2204598ee5124caabe1b1cddfed6d3ddf2e2244be4520a2efdcfea74a
SHA512

216f7bc01fd289bd4f99c283f90c97fd3bc232476d647e8d3fe21ccc7a1cce89c672dbd55bb2e9142d78f12f3d4f1d7e7d6e56fddead4f730d00c951795aeb98
SSDEEP

1536:7k876z3Ll7R8QD1PUOjohQ9tFZvUpuw54N7egZ:o87Ut1cHW9PZ8puw5g7egZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccef59f2204598ee5124caabe1b1cddfed6d3ddf2e2244be4520a2efdcfea74a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccef59f2204598ee5124caabe1b1cddfed6d3ddf2e2244be4520a2efdcfea74a.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download