d6794b9170b01b9a07ac6424817d1e5a5914267349d3fdf59e1bd952aeaac16f

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:02

Target

d6794b9170b01b9a07ac6424817d1e5a5914267349d3fdf59e1bd952aeaac16f.dll
Size

59KB
MD5

0fce2748fc7eb5ea45340b3749e18a08
SHA1

b3fbb375c64f0a33611d94cf9db8744148713241
SHA256

d6794b9170b01b9a07ac6424817d1e5a5914267349d3fdf59e1bd952aeaac16f
SHA512

95668affdd2c2a9518768901050fe7528a24e75d6ca01f9a140d12cc5a7fe55bd62992e593722d53de776406ac39fb8f5598c0ed010284aefb14b0071b6e0a8f
SSDEEP

1536:4XkTnJx72W+4smUOb5Z4p6Sdqy88zMJB/OP9ZJR:SKJx6WcmXb5mpDf88IL/ORR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28
PID 1596 wrote to memory of 1648	1596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6794b9170b01b9a07ac6424817d1e5a5914267349d3fdf59e1bd952aeaac16f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6794b9170b01b9a07ac6424817d1e5a5914267349d3fdf59e1bd952aeaac16f.dll,#1
  2⤵
  PID:1648

memory/1648-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download