ac9483f6b6f155fb761829af2742392c7717c4a4fc1801e96c3cba2a7324424d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:03

Target

ac9483f6b6f155fb761829af2742392c7717c4a4fc1801e96c3cba2a7324424d.dll
Size

84KB
MD5

65aeaa1dc1b7d34fe9224f817271028a
SHA1

c0a4d9c15d23fc435d25fcda0de058f7e8926e54
SHA256

ac9483f6b6f155fb761829af2742392c7717c4a4fc1801e96c3cba2a7324424d
SHA512

609f32e88876f4b082ee2682ad3b329fab929c89a5acfdd3412e0ed1d9eab7fc29c054c9ec3bcbb71d2e028671263cce5acb0380c5355ec7241af118c31adc76
SSDEEP

1536:147nGXrUmoI8P9GhQ2C2Kx3Wlc/J7oy4brZaaTBQ:1hF9M9p9pWlc/J7oy4bUEB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9483f6b6f155fb761829af2742392c7717c4a4fc1801e96c3cba2a7324424d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9483f6b6f155fb761829af2742392c7717c4a4fc1801e96c3cba2a7324424d.dll,#1
  2⤵
  PID:1228

memory/1228-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download