623faa3f1bd57837067ce7e47dcfc5f2062cc9ab96b72747dc18d858a7e2cfbc

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:34

Target

623faa3f1bd57837067ce7e47dcfc5f2062cc9ab96b72747dc18d858a7e2cfbc.dll
Size

6KB
MD5

fd8fc0f7b3b215c7419f2c11ad7dd8c0
SHA1

e06c225e975976a9ae5b04c18f94be9df29f081d
SHA256

623faa3f1bd57837067ce7e47dcfc5f2062cc9ab96b72747dc18d858a7e2cfbc
SHA512

42228ddc5d066d18f10885c9ef0251d3ef4a42ce8cb9bc286a3632415250b2bbc430e0c346cc670dbb2800e74455c7594eacde526a03614645127daf48ad8cd3
SSDEEP

96:z0I9wZLrY0/mKPaDdCNXMuaM1coYeYUYwDDAZ64AeePxM+YfP6M1HMj:JKZQW/3EZbZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28
PID 1764 wrote to memory of 1480	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\623faa3f1bd57837067ce7e47dcfc5f2062cc9ab96b72747dc18d858a7e2cfbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\623faa3f1bd57837067ce7e47dcfc5f2062cc9ab96b72747dc18d858a7e2cfbc.dll,#1
  2⤵
  PID:1480

memory/1480-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download