1a773f3f63635c9fdcb9b2b5d20c5a44c89a739b7a17ae845c4859ecf2cf1879

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:25

Target

1a773f3f63635c9fdcb9b2b5d20c5a44c89a739b7a17ae845c4859ecf2cf1879.dll
Size

112KB
MD5

8ad0490121bb7917e9b10ecd1daa3d12
SHA1

4c15e99782197b58aae3a95ae37868312806d4f8
SHA256

1a773f3f63635c9fdcb9b2b5d20c5a44c89a739b7a17ae845c4859ecf2cf1879
SHA512

4439ff73b211eb1d2760f51b4e2ea58d13cb2dffcc481b72cc0894fb3706dcaafef655d2d7bc5aae6ca94114f64cc815e2240543ed32d671de4bef60365bd103
SSDEEP

3072:NJnozboMgRkukWPPLb9ZVY6cKdXsrrEg:9HRbkMPLb9ZbhXsr4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a773f3f63635c9fdcb9b2b5d20c5a44c89a739b7a17ae845c4859ecf2cf1879.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a773f3f63635c9fdcb9b2b5d20c5a44c89a739b7a17ae845c4859ecf2cf1879.dll,#1
  2⤵
  PID:1496

memory/1496-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download