acbf79ca407c432b8eb72ed28f9175180c551460987e80f1c81330196750e33b

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 15:31

Target

acbf79ca407c432b8eb72ed28f9175180c551460987e80f1c81330196750e33b.dll
Size

68KB
MD5

b573eb97cc401ed2d03e6d8f76c4b864
SHA1

c2279a047381eef8ba21ee1181b09ad7001e5bfa
SHA256

acbf79ca407c432b8eb72ed28f9175180c551460987e80f1c81330196750e33b
SHA512

72acd391aa99ca9eb6119700d028476811853688ed9baa16d5d0dbba3f5ea693f6c00beaa56fcc05e6ac8f02e0fb4ccb5e98c055aa7eb0d954cd4a557d26a44d
SSDEEP

768:841CT3H5Hv1wUQsuAzaV+GB8o7Aiv7vGDvV6MV2ew5ORLN+1:841CT3HZ8A2ULo7AiD4Qow5ORJu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acbf79ca407c432b8eb72ed28f9175180c551460987e80f1c81330196750e33b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acbf79ca407c432b8eb72ed28f9175180c551460987e80f1c81330196750e33b.dll,#1
  2⤵
  PID:2036

memory/2036-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000000171000-0x0000000000176000-memory.dmp

Filesize
20KB

Download