a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:56

Target

a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll
Size

112KB
MD5

aa4e0d463d7bc3aa8d19e78688bfa1b9
SHA1

9e7467025b106383806583f3e198505b0c8518c4
SHA256

a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02
SHA512

d88bdf33e591eaf731fedfc81e74ee1b66ec79cf726c9cb9a5336eee5617e7510a994de4da136f6dd4b20c5c698e371171c799af379450584bc4464f7c6e7cde
SSDEEP

1536:tpfSJIs7a/U7Z/4cKDqxYwhyrb8gMCcbE6f47UZGo:bfSWcZQ5wsMCkE847UR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download