958c6930c54bb91f9e5c58ee5b49fcfef6ad3f3fb7696b3b59f21afab69f7da2

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:29

Target

958c6930c54bb91f9e5c58ee5b49fcfef6ad3f3fb7696b3b59f21afab69f7da2.dll
Size

59KB
MD5

d479cfcff86420f06e238b7d417396c6
SHA1

00d0db51f3777093b697286da796d4f8437a94bf
SHA256

958c6930c54bb91f9e5c58ee5b49fcfef6ad3f3fb7696b3b59f21afab69f7da2
SHA512

3e063c79d5f64a98134777e1240dd39b181f3eb27b1d612dc736f820acc2eddbe26d51ee1b0bf5f38f71adb1c56e057c8153deeb87d9eaf199bf9245d1781c7e
SSDEEP

1536:evnl84IHeneJMO8hVQLi9y1W43fZ/SbXX5/ofeULfK:Al8n+eQz4W6Qn5/WLS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28
PID 968 wrote to memory of 1316	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\958c6930c54bb91f9e5c58ee5b49fcfef6ad3f3fb7696b3b59f21afab69f7da2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\958c6930c54bb91f9e5c58ee5b49fcfef6ad3f3fb7696b3b59f21afab69f7da2.dll,#1
  2⤵
  PID:1316

memory/1316-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download