c41f34a1516b6ab021d4dbb2c6d799b5f7613815b5eb75bc5e544cd543cb98eb

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:44

Target

c41f34a1516b6ab021d4dbb2c6d799b5f7613815b5eb75bc5e544cd543cb98eb.dll
Size

6KB
MD5

0d9166886497958cb60a13eef9013560
SHA1

b26f90d514a0024b74b6998733da99d1be4c76f4
SHA256

c41f34a1516b6ab021d4dbb2c6d799b5f7613815b5eb75bc5e544cd543cb98eb
SHA512

b0097fd1ede96fc3d5db78a46a5395909a07c6f419fdd750411a4f253bdb5837abc618a41ba72d1603613beff251dbd5553378b59f83e32749501ca5e5802a5a
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHho:nEY2RrF1eqwi42

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c41f34a1516b6ab021d4dbb2c6d799b5f7613815b5eb75bc5e544cd543cb98eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c41f34a1516b6ab021d4dbb2c6d799b5f7613815b5eb75bc5e544cd543cb98eb.dll,#1
  2⤵
  PID:2040

memory/2040-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download