8ff0cb96c018fdccea4399f4f6c47e3427fbc4f1414bf70a2a3975e1c035ba11

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:57

Target

8ff0cb96c018fdccea4399f4f6c47e3427fbc4f1414bf70a2a3975e1c035ba11.dll
Size

6KB
MD5

d3b1200137323325ad79199faa33ffb0
SHA1

c60a350c80eafed3aec27f07b5e02b45a7794e56
SHA256

8ff0cb96c018fdccea4399f4f6c47e3427fbc4f1414bf70a2a3975e1c035ba11
SHA512

d5554167b8b74e8723049f7e496729a89206255a3e1feeb891409897dbeff91822573a89ac1093b49de8860668d91633496ea7dc280a1f42435935f7e86ca591
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9NzgYlr84/EsShHnfsmY3kgjr5qz2nLTme1uysst+B:VGEETrMLH5Zlr848PhH83pqzxg1dp8J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff0cb96c018fdccea4399f4f6c47e3427fbc4f1414bf70a2a3975e1c035ba11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff0cb96c018fdccea4399f4f6c47e3427fbc4f1414bf70a2a3975e1c035ba11.dll,#1
  2⤵
  PID:1920

memory/1920-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download