ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:24

Target

ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll
Size

76KB
MD5

58a9fb53a5bfc1752f079ea294242870
SHA1

eeced018e0deadc38234b3874847f9039d9be9ed
SHA256

ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829
SHA512

6d1143b5a7111f88294a2209cd4da4ae9d1a2a00e6dc18b2f4904ca11d3325fd074b02d8a671243ef3f1ca9fb0eb014e107a99ac081a78e373be9cfa72fb8fa3
SSDEEP

1536:IykzkagpyHkPndLmuTGpwPTAMANKLDrHh6cxwevnVYV:IFzkapEFauTAdhNKLD5uW+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1224-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1224-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download