caf9cf903df31426a8e2885c781a1ef786e0677f07901eed5a6437fa2e868801

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:03

Target

caf9cf903df31426a8e2885c781a1ef786e0677f07901eed5a6437fa2e868801.dll
Size

4KB
MD5

0638a8b006eb1d1a78a9af9ef7957cb0
SHA1

f17d69e70c35b09df503526c1479924a6b9cc5e6
SHA256

caf9cf903df31426a8e2885c781a1ef786e0677f07901eed5a6437fa2e868801
SHA512

e9a2611beee314f0f16a14a7d39e0bf0341af85f7e905fe03071d3edde78338f858c78fc1875f31d03a9eb292c403f32ecbd4cff93546718a57605ab6aac5694
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKQl8UVsXw1q2BitzWOu:PT3r2vu9VV3Q2otk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28
PID 944 wrote to memory of 524	944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf9cf903df31426a8e2885c781a1ef786e0677f07901eed5a6437fa2e868801.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf9cf903df31426a8e2885c781a1ef786e0677f07901eed5a6437fa2e868801.dll,#1
  2⤵
  PID:524

memory/524-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download