b6a6994786e02939a224656aa7087c8b8b5722de9c2ed1d0fe30dff4235c24ac

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:06

Target

b6a6994786e02939a224656aa7087c8b8b5722de9c2ed1d0fe30dff4235c24ac.dll
Size

27KB
MD5

abb6f77a22bdeafc6092d2b9049b7c8b
SHA1

771455b77e06a27e793f9fa7bc9109c775b64d4e
SHA256

b6a6994786e02939a224656aa7087c8b8b5722de9c2ed1d0fe30dff4235c24ac
SHA512

3668534bc81bcc6d0249540e900c90b57c3ab683b33bba3d2e1f16a571f851d1fee496e05d2f8ee564df1e8ae31e42e49c03a51b2f9170f4994f2e001183150f
SSDEEP

768:bowyehckZ8QI13K0XNvyyWVQA4aS17KiT99h1hJov:dl9UK0zVNtKiTDhs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27
PID 1768 wrote to memory of 1112	1768	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a6994786e02939a224656aa7087c8b8b5722de9c2ed1d0fe30dff4235c24ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a6994786e02939a224656aa7087c8b8b5722de9c2ed1d0fe30dff4235c24ac.dll,#1
  2⤵
  PID:1112

memory/1112-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1112-57-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1112-58-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1112-59-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1112-60-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download