9568eabcfba41591a041b3737c967b3d0815d2041a3420f149b1ceb942349380

Analysis

max time kernel
25s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:15

Target

9568eabcfba41591a041b3737c967b3d0815d2041a3420f149b1ceb942349380.dll
Size

6KB
MD5

13f42cd49c375ee98713edee015a52d0
SHA1

7b2f3cef8210eaff0aee60b2db2897f4c9fdbacf
SHA256

9568eabcfba41591a041b3737c967b3d0815d2041a3420f149b1ceb942349380
SHA512

dd57e77a4ed76724554b4809e1e1032b117a33d1d179e219f2e5efa13a9588dc7b54b96b67d35c9377d023ddb41157cbcae4722546037b980f6ad73d58e50751
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4ZcccVcccU3Gvocc2R+acccGZ:2M/SdjbgYkcccVccca6occ/acccQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28
PID 1268 wrote to memory of 1096	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9568eabcfba41591a041b3737c967b3d0815d2041a3420f149b1ceb942349380.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9568eabcfba41591a041b3737c967b3d0815d2041a3420f149b1ceb942349380.dll,#1
  2⤵
  PID:1096

memory/1096-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download