fe7f022c0973b5338556e6523c137d3e770612ac8fa5df3eb4b53a82fdfa9897

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:28

Target

fe7f022c0973b5338556e6523c137d3e770612ac8fa5df3eb4b53a82fdfa9897.dll
Size

4KB
MD5

91222e5b3fb01942ce89ce73889bac20
SHA1

66ae874135d8b875f62fd5692422a4e39fe9e3ac
SHA256

fe7f022c0973b5338556e6523c137d3e770612ac8fa5df3eb4b53a82fdfa9897
SHA512

84a9e3f7d79dd978ed7f43b48a81af8a1c004269892129f8599cd2f7b1e072467c477aaaa12d9b2adfebeb81e0efda3638157019ab12ef8a6f913408fb4dc5a8
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKM/o0MXOvUSQ3vbi:PT3r2vu9j/o0MXTS/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7f022c0973b5338556e6523c137d3e770612ac8fa5df3eb4b53a82fdfa9897.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7f022c0973b5338556e6523c137d3e770612ac8fa5df3eb4b53a82fdfa9897.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download