6215064e4266acd649c85cbaa8c9b90a4189c7f099c36689c1e9b67267f5a2ba

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:27

Target

6215064e4266acd649c85cbaa8c9b90a4189c7f099c36689c1e9b67267f5a2ba.dll
Size

7KB
MD5

75536d0a2d5b699ab6f5a2c6a0ca99a0
SHA1

cd0a37d1073ab985d57171a14eb9e3066cccbda4
SHA256

6215064e4266acd649c85cbaa8c9b90a4189c7f099c36689c1e9b67267f5a2ba
SHA512

ff5cb3d418971a617316a726b139e59d1e0a91318c23e578de199bf4978937e843b2622a892bbc935347183298f53cb8ab8ad7a194ceddaf3bda4b4473625063
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4egWF4/i5ixc9+CeyF42jvWzfKQ+6RLHL:2M/SdjbgYkWFlQHi1GH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6215064e4266acd649c85cbaa8c9b90a4189c7f099c36689c1e9b67267f5a2ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6215064e4266acd649c85cbaa8c9b90a4189c7f099c36689c1e9b67267f5a2ba.dll,#1
  2⤵
  PID:1432

memory/1432-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download