4073181b6d8f784b5c513cdc6493a5ad61121046a079e5dfd629e172bc74b405

Analysis

max time kernel
104s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:14

Target

4073181b6d8f784b5c513cdc6493a5ad61121046a079e5dfd629e172bc74b405.dll
Size

92KB
MD5

c0f3af822a98ef0c6d6e33432c7685af
SHA1

2be719099bc689257efab3c50952a9b1e175e39c
SHA256

4073181b6d8f784b5c513cdc6493a5ad61121046a079e5dfd629e172bc74b405
SHA512

01eddcc4ee92bad967ecc798559cb2a8165a39457b7b9bac7e14091e20a84ffc15db07a59c18d5e0fe05a055a65541078b2ab169f41e1c16f1c8ea4522d567ea
SSDEEP

1536:5tCV0V0EwaKIgPvAU+Gj9Oc5x0u7sqtmWZVxegSJ9U8OFcmsC:TCV0V2VIgP4U+Gj0c0ulvDebJ9UTFcg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28
PID 1260 wrote to memory of 1692	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4073181b6d8f784b5c513cdc6493a5ad61121046a079e5dfd629e172bc74b405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4073181b6d8f784b5c513cdc6493a5ad61121046a079e5dfd629e172bc74b405.dll,#1
  2⤵
  PID:1692

memory/1692-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download