faaefa12d7d27de759486a2ed2a720d9bc428a10bfc334975c7469d71b5eae67

Analysis

max time kernel
20s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 05:22

Target

faaefa12d7d27de759486a2ed2a720d9bc428a10bfc334975c7469d71b5eae67.dll
Size

104KB
MD5

1169977e330263450e614c4e9c15d27a
SHA1

5c1d1b443ec555656b694563466e461791b42b16
SHA256

faaefa12d7d27de759486a2ed2a720d9bc428a10bfc334975c7469d71b5eae67
SHA512

8a7233b3057cf67b6daef2281ffe3cda783ba3f793df6427b940e106f5a6950072c7bad9a2a1edfaeb73a07fdcc49d167ca289b2bb779a048101d8ef1f156c18
SSDEEP

3072:LjPjLvuE11NEx9u/iHve3szY1f0we6lvpw:fjLvu4IOL3si0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28
PID 956 wrote to memory of 944	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faaefa12d7d27de759486a2ed2a720d9bc428a10bfc334975c7469d71b5eae67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faaefa12d7d27de759486a2ed2a720d9bc428a10bfc334975c7469d71b5eae67.dll,#1
  2⤵
  PID:944

memory/944-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/944-58-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/944-61-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/944-62-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download