f6bb1cbfed9af809ae75715dd9ceea277f379d7204cc8b865e5ca90018818e75

Analysis

max time kernel
14s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:09

Target

f6bb1cbfed9af809ae75715dd9ceea277f379d7204cc8b865e5ca90018818e75.dll
Size

24KB
MD5

bfa3a484f41a2eb10682fd0393f46d42
SHA1

8aec0d5fe9c7b6e5ce24c0c161200a6b3e934513
SHA256

f6bb1cbfed9af809ae75715dd9ceea277f379d7204cc8b865e5ca90018818e75
SHA512

835f7bd558624901b3257cb9070ecb06b0a96320c272fda91ebe8727a807793960e3cc6df46aadff17c07da40d0df0b799a60a05d31b5391d60941e41ad48b57
SSDEEP

192:QraT2KYfBi9s+fiGO+aq7zXR1xDzFBA8Hgik/xUxdwyaIrTjn5nU1uOpct5Uc/T:b2KWf+fxO8ZzTAhxUL+IrTG1zpct5t/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6bb1cbfed9af809ae75715dd9ceea277f379d7204cc8b865e5ca90018818e75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6bb1cbfed9af809ae75715dd9ceea277f379d7204cc8b865e5ca90018818e75.dll,#1
  2⤵
  PID:1884

memory/1884-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download