abf2c353950c93eec0f1cceb454013d6a892690470405d7bcdd1e285ba5d753f

Analysis

max time kernel
24s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 14:00

Target

abf2c353950c93eec0f1cceb454013d6a892690470405d7bcdd1e285ba5d753f.dll
Size

16KB
MD5

3506df7879fe4bc711f3dbcafe32ddc0
SHA1

f39c54af66bfcf7a2b2a5c951253f1ec8de5431a
SHA256

abf2c353950c93eec0f1cceb454013d6a892690470405d7bcdd1e285ba5d753f
SHA512

e7d21119df60579338221793581af91fe561cb5c1150a8fed9edfd61d4ce83e608e3a0d3c16befdefd8954989eaa2f4f003e33e9d3546f3ba8d9242271689c38
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKV:JT0qmznB6rwUmRvRg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28
PID 1536 wrote to memory of 1700	1536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abf2c353950c93eec0f1cceb454013d6a892690470405d7bcdd1e285ba5d753f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abf2c353950c93eec0f1cceb454013d6a892690470405d7bcdd1e285ba5d753f.dll,#1
  2⤵
  PID:1700

memory/1700-54-0x0000000000000000-mapping.dmp

Download
memory/1700-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1700-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download