af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 08:55

Target

af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll
Size

4KB
MD5

74683a4ab466486fc783a09f7a9e8b10
SHA1

0ac53d97ef29995b032cca0308d10132f0f3246c
SHA256

af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110
SHA512

ddc8368a9fbf38362f3c2b3970be148a38f40182fc1cdb57526ecafdf4464e84d4874e0ad0f1faa9e00483e5650e29bf06dfddcd01d0b76999b3f6b7a106c282
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mmGgB4ydH9P1O:PmkiIz8UZrQ0MhI/ITqly9XO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download