ed1b7b1d8e297272ab9fa1f49c58e389d1d732de943700156e006c1665af5200

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 06:06

Target

ed1b7b1d8e297272ab9fa1f49c58e389d1d732de943700156e006c1665af5200.dll
Size

85KB
MD5

0ec22e420418b8c1ff44a2968ba16b40
SHA1

4bad582d6be5ae530b3b987e8898edef71a87575
SHA256

ed1b7b1d8e297272ab9fa1f49c58e389d1d732de943700156e006c1665af5200
SHA512

345a719d4cb9f360eac8941a0279790f219798202d50171ae716e279ab007f3ca6391390d8e24dbff4944e2469c05d51f33d0733547dc2c12d8308e42e730fd3
SSDEEP

1536:m8Y+LQ3zACHfOcnITmdGN24kD9parsZyQ7g:2+CMCWWITGOjkpyD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed1b7b1d8e297272ab9fa1f49c58e389d1d732de943700156e006c1665af5200.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed1b7b1d8e297272ab9fa1f49c58e389d1d732de943700156e006c1665af5200.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1756-57-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download