9e3271c6316fd2f556f2e23aca120e9387c5dd3665205c7d6ff391f868db2053

Analysis

max time kernel
94s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:13

Target

9e3271c6316fd2f556f2e23aca120e9387c5dd3665205c7d6ff391f868db2053.dll
Size

7KB
MD5

81877978cd355832978fefaa1be4ae40
SHA1

9c6ac47d26d746a0fb3aae599ccf59bf4e0e70d7
SHA256

9e3271c6316fd2f556f2e23aca120e9387c5dd3665205c7d6ff391f868db2053
SHA512

809b65f1e397366391d13e1a17697586e856f17b007faff50aec0d843472237c10912ea19709848d3c738747a779c87461bc85758b7ecdbdf39247e31766feba
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4HUsG24RtfYM0d3P+11e8MCDLLPF+HRTbtY9hx8KTgg:2M/SdjbgYh24R+MDScDL8RTWGK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28
PID 1224 wrote to memory of 336	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e3271c6316fd2f556f2e23aca120e9387c5dd3665205c7d6ff391f868db2053.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e3271c6316fd2f556f2e23aca120e9387c5dd3665205c7d6ff391f868db2053.dll,#1
  2⤵
  PID:336

memory/336-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download