9f1365539f5dfdb4f7fe2237868207cbb7e6edb5e111b6993216baafc8a6ce8d

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:35

Target

9f1365539f5dfdb4f7fe2237868207cbb7e6edb5e111b6993216baafc8a6ce8d.dll
Size

4KB
MD5

d95adb0a6efd8c40a4d7c72282640760
SHA1

e510c72d6341585382446791a2859e5507a51207
SHA256

9f1365539f5dfdb4f7fe2237868207cbb7e6edb5e111b6993216baafc8a6ce8d
SHA512

bec2217851b15b3c603e5652367bebec612d3bd1bfa2df3d8dafa7ce04a7b3b9d1d071d101e19711f28070a0c9ef02a76c527a303d279316b9608084ce4ebd00
SSDEEP

48:q0Z48j1gA5YHofrhWR0/iIsipbYtDfXgOrnsB/S+0cmXro7bYA1k:1tRn5cofrY06I/VY1no0Vt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f1365539f5dfdb4f7fe2237868207cbb7e6edb5e111b6993216baafc8a6ce8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f1365539f5dfdb4f7fe2237868207cbb7e6edb5e111b6993216baafc8a6ce8d.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download