d00861e33cc2d20a6157359cbce92813533bce17b0c5dad84ba72ae2c4ca0a34

Analysis

max time kernel
227s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 22:01

Target

d00861e33cc2d20a6157359cbce92813533bce17b0c5dad84ba72ae2c4ca0a34.dll
Size

40KB
MD5

9a1d0f065361c3cdcd7515fec41c3756
SHA1

798d7958a3685342cb4914493555d24aaeb33a0b
SHA256

d00861e33cc2d20a6157359cbce92813533bce17b0c5dad84ba72ae2c4ca0a34
SHA512

bc5f349aab857066d723700391c29718bf9000b6309f8a8d18c1b86a7b3add0df15ff4464ac8af2d362eb20fe48636a82f89b5014a3ca71a0f035992f7134a32
SSDEEP

768:xlPHgFEwWZLvKzU7kAG7066tX+hP6jWBoRvc:xlvg0KzUQn7066tuhyaoR0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28
PID 564 wrote to memory of 1120	564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d00861e33cc2d20a6157359cbce92813533bce17b0c5dad84ba72ae2c4ca0a34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d00861e33cc2d20a6157359cbce92813533bce17b0c5dad84ba72ae2c4ca0a34.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download