f6fb5601009d08e5e40eee1c37468140a5252cb042a9d064fb7cd75d431675ee

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:33

Target

f6fb5601009d08e5e40eee1c37468140a5252cb042a9d064fb7cd75d431675ee.dll
Size

5KB
MD5

5a4bcd3aa4206df57e5841cfe5a28850
SHA1

7fbf978f7f6e5fa19e14566b1edaaaa8a6ffa4c2
SHA256

f6fb5601009d08e5e40eee1c37468140a5252cb042a9d064fb7cd75d431675ee
SHA512

1d1b4dae471da7856a60363965ff47d51281ccf947689872924e76cc2225ccf471086fc0091648752b8866d42726bc65217bc839746e899b17173ebc5681c2d2
SSDEEP

48:a5zjMTGcITBVQVE1lcxqR0VTKpe96dTOCbaNpdvht0i9avEOhvI+:iT3Qu88aVTXQTObtt0i9ackI+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6fb5601009d08e5e40eee1c37468140a5252cb042a9d064fb7cd75d431675ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6fb5601009d08e5e40eee1c37468140a5252cb042a9d064fb7cd75d431675ee.dll,#1
  2⤵
  PID:820

memory/820-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download