6c724ceb0eb88208ee0b22814e79b79b34d131f6cb01b07f6c512b541a2940ef

Analysis

max time kernel
4s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:31

Target

6c724ceb0eb88208ee0b22814e79b79b34d131f6cb01b07f6c512b541a2940ef.dll
Size

42KB
MD5

7c50a1aa29ceb12705b832c215b62025
SHA1

03d37e45b2418c1301dc31184a3817011d5b90bc
SHA256

6c724ceb0eb88208ee0b22814e79b79b34d131f6cb01b07f6c512b541a2940ef
SHA512

68bf758031d152202364897b3f7c5b0ae69e561089116ca307c920064a9e3205ce152c6d2ae200610dd753cc75cdf2559f7d6d58df24e700fbf86c06a02f2f0c
SSDEEP

768:ulAqQidiEgzdbkpjhWToENNqDKt76mr7TKttBro7PpPJdTWBnRECriM:aA/6bgzB0FENNqCFr7TKJroBLanREC/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28
PID 2040 wrote to memory of 960	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c724ceb0eb88208ee0b22814e79b79b34d131f6cb01b07f6c512b541a2940ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c724ceb0eb88208ee0b22814e79b79b34d131f6cb01b07f6c512b541a2940ef.dll,#1
  2⤵
  PID:960

memory/960-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download