f0c0b2a5c00a8928de9681016c8f172b21118355db9dde5868517c75de23e790

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:58

Target

f0c0b2a5c00a8928de9681016c8f172b21118355db9dde5868517c75de23e790.dll
Size

33KB
MD5

6f759fecdd33d736c714192499e195f0
SHA1

844c504887e6b60baab47923ad1e4c600ebe6f69
SHA256

f0c0b2a5c00a8928de9681016c8f172b21118355db9dde5868517c75de23e790
SHA512

9d7c3b9674efd192525f0217e611a27f2fa84ac2cab8e6b489a878352d27d5fb22e64a54d61298bcc7f2ff2706d936f8637efdafbcadec2d704d1d0d723150b4
SSDEEP

768:ZX5wlHbBOm1e6Y31CLlr7yV7/1GVF5lhCDmERatV:V5QNOm16FChS7/1GVFL8aER2V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28
PID 1460 wrote to memory of 880	1460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0c0b2a5c00a8928de9681016c8f172b21118355db9dde5868517c75de23e790.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0c0b2a5c00a8928de9681016c8f172b21118355db9dde5868517c75de23e790.dll,#1
  2⤵
  PID:880

memory/880-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download