86af0e34e8964151a0077a62443110fac0d93b65efbd508156ef786f0f04d5c0

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:47

Target

86af0e34e8964151a0077a62443110fac0d93b65efbd508156ef786f0f04d5c0.dll
Size

6KB
MD5

c33143ada0708271d885f25d932ec630
SHA1

018d8ef55a146f469788c15eadfb5cb33908253d
SHA256

86af0e34e8964151a0077a62443110fac0d93b65efbd508156ef786f0f04d5c0
SHA512

2fd42b0e6437c003e2c5e080f898e3f2511003787ccc6bc5d01077ceec56543ea2867e76db9c115e2f77505d2a045a4f43ace35c4349dcc26be110e26af253ea
SSDEEP

96:nEY2RrF1eqwi4t9ELBnLuiIcPq5ga3NduZ0BT8G94u5Vfcg3IH9TkP9OC6C1nt4l:EHRh1eppMLZKiTPENduu18GbOmO4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86af0e34e8964151a0077a62443110fac0d93b65efbd508156ef786f0f04d5c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86af0e34e8964151a0077a62443110fac0d93b65efbd508156ef786f0f04d5c0.dll,#1
  2⤵
  PID:896

memory/896-54-0x0000000000000000-mapping.dmp

Download
memory/896-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download