9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:13

Target

9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll
Size

4KB
MD5

56320a664ff3b9ccd5596c0ffde575b0
SHA1

9c6c0cd1300019e204e4b5613349edffd7bd50f8
SHA256

9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160
SHA512

75670efcbd176b57b27fe0732e2d136228a4837ae436213c17ad4e18554fdd32e65e9d7eac21f2838ddac9756dbbf6f3ecbb2fe669b5d625d4c57527a80fb8db
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LGKuIjBNoH30IJEjk3UwH7q14Ab9x/0aX:TRphMzf8VjgHEIJF3UwHe+2x/e5xQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll,#1
  2⤵
  PID:1036

memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download