f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197

Analysis

max time kernel
53s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:26

Target

f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll
Size

36KB
MD5

6f9d95518a033a308620f6953c466980
SHA1

c169e590fea1a40f39a2b2d0911fc5ad4408b212
SHA256

f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197
SHA512

31a818a8809c0d1fae7ed0b338fb48401c181e6fdd6d1aaf53b4c3bac918a5e448595c7d3c6103b211184b1d191340a10a387fb179b72612e065f0cf24e8de05
SSDEEP

96:qZ/Gom9y95CpIdFTbX2sqhA5WO9I//LfhhhemeHMol1xT:qBm9c5CpaXehA8O9I3zh+meHMolf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27
PID 1688 wrote to memory of 1044	1688	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll,#1
  2⤵
  PID:1044

memory/1044-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download