9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec

Analysis

max time kernel
1s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 08:54

Target

9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll
Size

11KB
MD5

2a304725b6eed080000339ebd417e9f7
SHA1

8368cc40f45ccceb003a45e788f152d1476e9a14
SHA256

9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec
SHA512

2844fd9179ac013bceae1bc1075643eef94ae82a08d0b9349b5502e45efbff09ce6a87fded4e0b215a761bdd993a2132612a72ec1b0a2679647cde90990aafce
SSDEEP

192:cUeniB1xmgfTpHeJTFoDZZPMRHgUG7/nXLUD3OrPn/jiZgl+QWZRt:3enimgfpeJE0xG7/nXOej+ZtBz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll,#1
  2⤵
  PID:1380

memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download