320fddd681a5f66de7b110e9fca24a9967089c04a81390af9377c487800c55de

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:45

Target

320fddd681a5f66de7b110e9fca24a9967089c04a81390af9377c487800c55de.dll
Size

7KB
MD5

42fb6d5cb7c8f78112b8e110c62132a0
SHA1

eee59d700f8a69a2e4017bc0ee6bedf2c7ae3e3f
SHA256

320fddd681a5f66de7b110e9fca24a9967089c04a81390af9377c487800c55de
SHA512

a126b8d74e880d81e7cf31d34c047395cb34ab93a44a6f1855dfaff65479eef6cd2edfb7bb0284e874372e9533c96481551be0f721c6152dae1d6f12a5529cb9
SSDEEP

96:PMXB0rw0MI/pwbd73P4Ln9KVZQg9CI8rJEt1jWYkOeGIUHV:kXIwbdL4LQVZQgsEPka1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27
PID 1392 wrote to memory of 692	1392	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\320fddd681a5f66de7b110e9fca24a9967089c04a81390af9377c487800c55de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\320fddd681a5f66de7b110e9fca24a9967089c04a81390af9377c487800c55de.dll,#1
  2⤵
  PID:692

memory/692-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download