cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:24 UTC

Target

cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll
Size

6KB
MD5

702df7a840dc2585c03626ae6945f770
SHA1

7751793e18045da33026d63fdd285a037f286206
SHA256

cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633
SHA512

5710b41182065d3e2dac4fb692dc66473aedbbe414f9280edc2f63d88684585b63c27175087a4d94cd89537621abff8742ab0185a763b21bb36a454aa4c215b6
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD76hXaF:nGTWJGp0UZUd6378snt7kaF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27
PID 1968 wrote to memory of 892	1968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll,#1
  2⤵
  PID:892

memory/892-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download