ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1

Analysis

max time kernel
11s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 17:55

Target

ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll
Size

338KB
MD5

0d5f88d2107056ada1ba513891f7f91d
SHA1

3f5d7b43340ee9018b9517338eae7184ee485465
SHA256

ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1
SHA512

e8bb8bb9043190548a10b6525c2302a7b28bd1590edea2b16a1c4adacc31696bd74053eeaa4ffdf5017416f2aef1f54aeebb6178ae6c5a933639501bed632f57
SSDEEP

6144:E80W354Y8wjhPzEvn/J3oa4FtDTtUhOSsSiQdTBov9f:v54Y8OPcutHSOSsSfdTo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll,#1
  2⤵
  PID:2044

memory/2044-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download