cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:10

Target

cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll
Size

206KB
MD5

a3a7f9f4bdfc99e5c231d8176f4605c5
SHA1

a798c566581aaad8b9ffca4a9c08ae0b51510217
SHA256

cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109
SHA512

8b7b22003752aeb4d37f2473614558c12ef1f9b93307188d997474342b83defa01a47115f425550d3d38f9af1d1a46c9d332e8aeabeb1fb8ac00561ce652d0a9
SSDEEP

6144:l1DGl8VKOe250FO3pPdjJIy3irACfjpkt:lxGaUOe25aavjJIMAfjpk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27
PID 836 wrote to memory of 1996	836	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download