d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9

Analysis

max time kernel
14s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:35

Target

d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll
Size

6KB
MD5

ed7fbc86903440e0460ffe6fb07fb130
SHA1

a64ee16edb8330058832af9594420c24c45e0ff0
SHA256

d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9
SHA512

d73a40561e7dc1e99afe333ab7fb4149499ca08173692140a0adcfb1fcee4324ca740fbb72244f8a348e2b86c01afc0f09821ba2ba77e3993fc654d15d31ad92
SSDEEP

96:iT3Qu8uz0KXqs+drGlvHpfD/vCpnZWVl19qcG:izQhqbPXllD3yI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16
PID 828 wrote to memory of 1260	828	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll,#1
1⤵
PID:1260

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828

memory/1260-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download