e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37

Analysis

max time kernel
20s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:42

Target

e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll
Size

6KB
MD5

6fb236f5d8ec92d2aade82738b6138fd
SHA1

20a3424e3445b2f68275e659ebbf18f83a18c8f4
SHA256

e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37
SHA512

9e675dd9563bd0e64fc618e25930196b66a183d92720b67e6ab0f21cc968811717f45158c530cf436463775652f15d2eb53039efd9a3cfb17a752268de64ea74
SSDEEP

96:Iadzcf8g1QmyZFPCJ+1nTDidIvb/8yOYtBuGKFaTj7yicApxppVSz:Iaw8eQBU+RXiart/tBqGJxH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1756-57-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download
memory/1756-58-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download