a8fd7afa6f49692a9f3e9bca02cbeedd1a428dfa3ab96b76960e57c405460e4f

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:49

Target

a8fd7afa6f49692a9f3e9bca02cbeedd1a428dfa3ab96b76960e57c405460e4f.dll
Size

56KB
MD5

97876ba0e8b749d762609b5d431fe423
SHA1

99f4a493189ec9ad37d1cf1febbd68c2718bd8a6
SHA256

a8fd7afa6f49692a9f3e9bca02cbeedd1a428dfa3ab96b76960e57c405460e4f
SHA512

bbc73aaf304166c5acec692b4866486734a3ad3f31bfadb8376255182aefcdd543f79c111eaf3e0c66c58ea83712e21d289bd16f715610f688785cf471c9226f
SSDEEP

768:LtTKsLw0UjFLtRSbO/NMqpFPF6KFnjgCgqm2uVo6/aH:AsLwDjZtREO/nXPpRo12uV2H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28
PID 604 wrote to memory of 1192	604	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8fd7afa6f49692a9f3e9bca02cbeedd1a428dfa3ab96b76960e57c405460e4f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8fd7afa6f49692a9f3e9bca02cbeedd1a428dfa3ab96b76960e57c405460e4f.dll,#1
  2⤵
  PID:1192

memory/1192-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download