fa95e138605513120ccd5c9ddce3a9b294631e74a60cf9bfd29cdd525331b303

Analysis

max time kernel
43s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 10:53

Target

fa95e138605513120ccd5c9ddce3a9b294631e74a60cf9bfd29cdd525331b303.dll
Size

137KB
MD5

12bf9ab58ad0a191bd4538fbd0892a70
SHA1

bd6a7db408d865ffaabcaa24af2f196aa8208fbc
SHA256

fa95e138605513120ccd5c9ddce3a9b294631e74a60cf9bfd29cdd525331b303
SHA512

32269ff3132eebf6ac6400b3b47f84d407b3d030f2fedc35ecf4d1e0508ea009ff4e52128780175c0c4aa03e9b6396efa9401209521fff4e865f10f3d7fdccab
SSDEEP

3072:S8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxL0ILi:S8w6D4Kotup0LWI+fM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa95e138605513120ccd5c9ddce3a9b294631e74a60cf9bfd29cdd525331b303.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa95e138605513120ccd5c9ddce3a9b294631e74a60cf9bfd29cdd525331b303.dll,#1
  2⤵
  PID:1348

memory/1348-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download