94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013

Analysis

max time kernel
6s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:27

Target

94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll
Size

70KB
MD5

6a9b3f86c2ed55075fee7cfb87bb4faf
SHA1

c491343bb78f4d19f7ecaecb37d2a89e2f53927e
SHA256

94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013
SHA512

c04824b4a4e6857dd4abf61ae5cc708aa48ff4fa690a9acc860d3e57dd9e5806ca0ed7b4fd43f43581a3cb0c7e70cbc70bd44afdca2d6859aec4fb4c81e08a96
SSDEEP

1536:yok0mU99hODEJE1opQn2v6a1uR/fgsQZsSKN1yZn:/massEvn06a12fgsjSKNcZn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28
PID 1776 wrote to memory of 1800	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll,#1
  2⤵
  PID:1800

memory/1800-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download