d9c1b21547e21e28153f949e60386800d410ffccb6adf3555a299411d5da77b1

Analysis

max time kernel
33s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:31

Target

d9c1b21547e21e28153f949e60386800d410ffccb6adf3555a299411d5da77b1.dll
Size

88KB
MD5

880aac6f4aefcb512d2c79df5e147ee3
SHA1

b705c459a1099d9c9a9ac076bf0aada6aaf97a6d
SHA256

d9c1b21547e21e28153f949e60386800d410ffccb6adf3555a299411d5da77b1
SHA512

e98459e83cdd23f34ab4115c06acc261196f7600925244855c2b3054595ed0e11e89e3f18a1dbffd5641f652334be084b71130defaff66b4f7d633541d764ded
SSDEEP

1536:OkzBS5SxeZXxSdKRc/3Gx7Cpd1s/UsBDZ+:xYSx5a43GlCX+U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28
PID 1884 wrote to memory of 1696	1884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c1b21547e21e28153f949e60386800d410ffccb6adf3555a299411d5da77b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c1b21547e21e28153f949e60386800d410ffccb6adf3555a299411d5da77b1.dll,#1
  2⤵
  PID:1696

memory/1696-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download