fce4b2f3a60ad9b24c6bb1eb45f4fd4de48a212bf4a9c8313263ad1e0e929747

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:40

Target

fce4b2f3a60ad9b24c6bb1eb45f4fd4de48a212bf4a9c8313263ad1e0e929747.dll
Size

5KB
MD5

a8337460c36224640359c8418226b460
SHA1

d7d3257b6b75aa6fecfc856f29ce86c5e83b6bb1
SHA256

fce4b2f3a60ad9b24c6bb1eb45f4fd4de48a212bf4a9c8313263ad1e0e929747
SHA512

c0c73494fd17c16f84e73930fa76a5bc2733d6e274ab59c7d898cbb3f345bd799775d58440edeab5a09adf9ea2fc8f66323ca5acfd43b7c4ce6ba117f24c8d03
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhA1xnKqS4ECoLTt7t6o8:nEY2RrF1eqwi4kxnKqwCovtwo8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27
PID 1628 wrote to memory of 1872	1628	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fce4b2f3a60ad9b24c6bb1eb45f4fd4de48a212bf4a9c8313263ad1e0e929747.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fce4b2f3a60ad9b24c6bb1eb45f4fd4de48a212bf4a9c8313263ad1e0e929747.dll,#1
  2⤵
  PID:1872

memory/1872-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download