9ba12093858d941c6d69a9a4ab7358d9657fcd1a403e40bd558f612df1becd14

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:32

Target

9ba12093858d941c6d69a9a4ab7358d9657fcd1a403e40bd558f612df1becd14.dll
Size

60KB
MD5

dedfaf2ba664f5111167e31870f515a0
SHA1

215d3d07fcb6701563681424205b41c6553c9bc9
SHA256

9ba12093858d941c6d69a9a4ab7358d9657fcd1a403e40bd558f612df1becd14
SHA512

40b493e1839b36ba5087ea46a4d0b0545a40c773708991d8377a66484db755f25e356851355600abefdc830cc6361777113f7dd492bcebd3e7b5eebfc226ec3f
SSDEEP

768:UuVNeNjEN5w1nzIDFB4e73BqKOkf4B/OQ7VJ47UAyoPIs8WHit/:jV8NqMnzKN4KOkf4BWsziUAy/9jt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28
PID 1992 wrote to memory of 2000	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ba12093858d941c6d69a9a4ab7358d9657fcd1a403e40bd558f612df1becd14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ba12093858d941c6d69a9a4ab7358d9657fcd1a403e40bd558f612df1becd14.dll,#1
  2⤵
  PID:2000

memory/2000-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download