6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc

Analysis

max time kernel
39s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:50

Target

6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll
Size

72KB
MD5

da27c46bc39612338195085c26811510
SHA1

85ac33b951b4bd543975b18f4eaccb9f9d4652a3
SHA256

6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc
SHA512

3da08bbc0aabb2077b262928fefda87276ac3c83c74be187e9ec08bd0040e13a6b74cebe9e41af5529cd9e2413dc443957afb33d005ce1b2da87c68e50ca9d60
SSDEEP

1536:UEdyxznQASyG6GKcxqzfibs0OHAvPKOK5zRzp1d:UEdgjQ16GK2qTibshCPKOK5zRzp1d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll,#1
  2⤵
  PID:880

memory/880-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download