9b7dbf3d21aa153db4d6726dab86365fcca45e3648cecb60babdf225434dc0ec

Analysis

max time kernel
216s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:20

Target

9b7dbf3d21aa153db4d6726dab86365fcca45e3648cecb60babdf225434dc0ec.dll
Size

133KB
MD5

65e2283bc1cef407f6909bcb9e062744
SHA1

d8cb5f4c39cfb12b820e02d222d2c926fa19eb77
SHA256

9b7dbf3d21aa153db4d6726dab86365fcca45e3648cecb60babdf225434dc0ec
SHA512

15f9d2732a966d881c3cea89f3ac14fa8a31ca1fe5010a3a274ad6ca7f42d72eb41a0a659e363c8f8988c79a56422bc508b670b0c1ca4835054137250324e0ef
SSDEEP

3072:h9aNTu9c0I0v4mWsqdSwfhNOEQjll7znZ9Z266OEUYFKXW3j:h8wc0I0v4oqdSwfzOPJhzZ9ZzfpC0A

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7dbf3d21aa153db4d6726dab86365fcca45e3648cecb60babdf225434dc0ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7dbf3d21aa153db4d6726dab86365fcca45e3648cecb60babdf225434dc0ec.dll,#1
  2⤵
  PID:1916

memory/1916-55-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download