f92a9592f70e57b7a71df8300da55ed65bb059f962728090d4a0021a93a6f573

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:38

Target

f92a9592f70e57b7a71df8300da55ed65bb059f962728090d4a0021a93a6f573.dll
Size

6KB
MD5

28516a6888bf04af7bfe4e963336bb90
SHA1

b6160a86270fe068482f394f56d67894e29cf54b
SHA256

f92a9592f70e57b7a71df8300da55ed65bb059f962728090d4a0021a93a6f573
SHA512

4da1c5b3b591ba7c82b7edc6588a5bc842200bf723a649522f5b7d1d603762c89d9607b296b3109762d3f9313bd654a14720ed488bf9956a70fbf7c120fd6038
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7MqBa5:juLJ/oAdQPQa2aeng77Ba5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f92a9592f70e57b7a71df8300da55ed65bb059f962728090d4a0021a93a6f573.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f92a9592f70e57b7a71df8300da55ed65bb059f962728090d4a0021a93a6f573.dll,#1
  2⤵
  PID:1472

memory/1472-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download