9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:43

Target

9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll
Size

7KB
MD5

cab50ac4e5ca4ce047b3432a2c6192f0
SHA1

d8f090974046cd870748e246a63e2389c60bbc63
SHA256

9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696
SHA512

8ffc7e4209fcf07c46e95bc4615e9bf32d7f4a631a646e28a7e5fb4c7324c0309b8c82685a7b067cc454d1ab3a272614161a76c250738d092d8b61da79a5ed23
SSDEEP

96:eQGiVnlT+cwazAIVI1nmLbEIjc5ikVlLkVLucw3DhDPyJz2AFp+VDzrM1ECnIxZn:eQNTsNI+jkpucw3DZBAa5WxI706ptB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28
PID 1900 wrote to memory of 944	1900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll,#1
  2⤵
  PID:944

memory/944-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download