61ebb2b6ef8bf43cd785a344337e01a49e4359f2579ba452c8f1a978cfa9400f

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:54

Target

61ebb2b6ef8bf43cd785a344337e01a49e4359f2579ba452c8f1a978cfa9400f.dll
Size

34KB
MD5

b0979a3aca5c370fcf8dab7c39e21d7a
SHA1

bac23df2ec49d825a18049bdd01cd911a7258e6d
SHA256

61ebb2b6ef8bf43cd785a344337e01a49e4359f2579ba452c8f1a978cfa9400f
SHA512

351e2cee71a38746ce7fa1b48ac17a2a6853e7c796cc7e72807a6b1a42747f2d1b9a652b9330e2361f174bc7ac476d66be7df3a784b381cabab44b3b2d9b4cbf
SSDEEP

768:OqCM7tWeKCJfaEtOexFjAOll7wzxOSO1m2OMjRGgKr:OqR7OotOe3MOf7wzxoRRN2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ebb2b6ef8bf43cd785a344337e01a49e4359f2579ba452c8f1a978cfa9400f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ebb2b6ef8bf43cd785a344337e01a49e4359f2579ba452c8f1a978cfa9400f.dll,#1
  2⤵
  PID:1516

memory/1516-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download