94b6a7d5ebb4756a45c250351ef93470fe5e7b11d9af625aa8f17a5c41a0f197

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:32

Target

94b6a7d5ebb4756a45c250351ef93470fe5e7b11d9af625aa8f17a5c41a0f197.dll
Size

75KB
MD5

a0f3b0f978237003c10f651c53dd6290
SHA1

a83c4c39d1cd5cb7b4e9eaf557df67302eab79aa
SHA256

94b6a7d5ebb4756a45c250351ef93470fe5e7b11d9af625aa8f17a5c41a0f197
SHA512

17a697f60dafe33bdf88fad4e3b1d1b8c7129080df9c2a4c3f5ae7af98af6e1676e9c6b439fdca817b45152655862480102768f324077b2fa99901ecba59f972
SSDEEP

768:OA2K+U87HmEHs4EzTeEtgOnfZAfy2VNpeXLa1hEbIo9QV8IS:O3PEzTeSfGy2VNALYScoNIS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6a7d5ebb4756a45c250351ef93470fe5e7b11d9af625aa8f17a5c41a0f197.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6a7d5ebb4756a45c250351ef93470fe5e7b11d9af625aa8f17a5c41a0f197.dll,#1
  2⤵
  PID:892

memory/892-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download