9fdb219ecae33f0b8ad03dbbf93eae3f3e5e4e84859aa4b9b070076e7b90756b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 10:45

Target

9fdb219ecae33f0b8ad03dbbf93eae3f3e5e4e84859aa4b9b070076e7b90756b.dll
Size

315KB
MD5

f12d670f74d40d35b253617ef44947b9
SHA1

e0997232a519561d167f4cfd652cf6df342b26d2
SHA256

9fdb219ecae33f0b8ad03dbbf93eae3f3e5e4e84859aa4b9b070076e7b90756b
SHA512

69215af36c9b6b59b1ed65e74b0d3ca7359a8d43967e8a862fece9531da16397a1fcd54d4695d353fef5ff3ccafa3d4d728bc29c3994904e114b3cab4d79e16c
SSDEEP

6144:0eXNtUublH+LlqUqs01naN05dgbr1TBLHyjB2F:0edt7tOlPqs0haN4Er1TRHyj0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27
PID 1600 wrote to memory of 1812	1600	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fdb219ecae33f0b8ad03dbbf93eae3f3e5e4e84859aa4b9b070076e7b90756b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fdb219ecae33f0b8ad03dbbf93eae3f3e5e4e84859aa4b9b070076e7b90756b.dll,#1
  2⤵
  PID:1812

memory/1812-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download