e27c0073ef63d33c096a02eeb1f7c4511b196a4a3fb23ae7c5537850625c5b4c

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 03:28

Target

e27c0073ef63d33c096a02eeb1f7c4511b196a4a3fb23ae7c5537850625c5b4c.dll
Size

89KB
MD5

0399a88bba08663cb22f6fea6ff51f02
SHA1

e9a53fc96f1dfc8871d38e8970f8e13e9acc8324
SHA256

e27c0073ef63d33c096a02eeb1f7c4511b196a4a3fb23ae7c5537850625c5b4c
SHA512

2b9adf737428cd0817d499be648297b548694b12310a574d764f5cc16d3d76d6c194af2ee610d31c07df03cbfdc24faf5e73a7dfa87e41a05e92891550b87791
SSDEEP

1536:djqjoQ05q12JX+Xfqtqel/pMn8yilaG8sIT7hQnokNxOKa2GVrh2lWguKtIs:goJa2Qfeq4/p28JlalsIT7hQnpNgBVN+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e27c0073ef63d33c096a02eeb1f7c4511b196a4a3fb23ae7c5537850625c5b4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e27c0073ef63d33c096a02eeb1f7c4511b196a4a3fb23ae7c5537850625c5b4c.dll,#1
  2⤵
  PID:1668

memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download