0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab

Analysis

max time kernel
28s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:28

Target

0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll
Size

6KB
MD5

a87be6773e50a891ad4ddaefab2a2e80
SHA1

ce86f8ac01e8bd33ede1451a1e349ae941aafd9f
SHA256

0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab
SHA512

a748b6f0938c6c94e21ce561dbca3639a18318fb69117a563cc2c5ca0dc2e8be5b619c3faa4d506d7c1063e9c9afb2acc2e0bc1a738cfdbaaeabf5c3144bd874
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhS8JzqcLEB0cl337zGNZ3Fm/zJ6l:nEY2RrF1eqwi40w/Q1Gr3c7ZKHX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27
PID 1292 wrote to memory of 1248	1292	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll,#1
  2⤵
  PID:1248

memory/1248-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download