c6610cff19b8dd5c96d7bc7660e3a22b2d71bc8c082fe841dd1bb48b06cd154d

Analysis

max time kernel
5s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:04

Target

c6610cff19b8dd5c96d7bc7660e3a22b2d71bc8c082fe841dd1bb48b06cd154d.dll
Size

4KB
MD5

cf36b2b538776f4068bceb3658f43670
SHA1

cc1678fe07bf192f21db795094a45c99653eccdd
SHA256

c6610cff19b8dd5c96d7bc7660e3a22b2d71bc8c082fe841dd1bb48b06cd154d
SHA512

13682de7c10021707565534de477b58ded0e8bed95699e836644bdb1371fe7fc76b9a422c01693e3917768aa8f044067ee060805e895bc8fedd573bf79c2319d
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKqxTUn9V0auL8UkoV2q:PT3r2vu914n9V0aGpkW2q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28
PID 1808 wrote to memory of 2028	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6610cff19b8dd5c96d7bc7660e3a22b2d71bc8c082fe841dd1bb48b06cd154d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6610cff19b8dd5c96d7bc7660e3a22b2d71bc8c082fe841dd1bb48b06cd154d.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download