f6f1d055fee6f584cbfbf971443130055c84e2d1e105e04f5671e2c2ca0f5bdb

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:17

Target

f6f1d055fee6f584cbfbf971443130055c84e2d1e105e04f5671e2c2ca0f5bdb.dll
Size

48KB
MD5

9d648fee79209cb2d39e9f145ba8734c
SHA1

de5453640e591276d40a87a43f4db276e2308616
SHA256

f6f1d055fee6f584cbfbf971443130055c84e2d1e105e04f5671e2c2ca0f5bdb
SHA512

85a3d601d6ea7d87581f3b99f6e4c72b042a9dffc8310bd2a5a4c87f5fb4ba5aa76c79e3fbb9d1e7b64fb6c7e2814078899f37728a69aa70742734f40333a845
SSDEEP

768:J2JhtR7uTTd/EYTOMwl1bKBN8wtTG89hOWI8wdiQmu:khtRU/EYT3wbbKjthhOW7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28
PID 1716 wrote to memory of 1792	1716	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6f1d055fee6f584cbfbf971443130055c84e2d1e105e04f5671e2c2ca0f5bdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6f1d055fee6f584cbfbf971443130055c84e2d1e105e04f5671e2c2ca0f5bdb.dll,#1
  2⤵
  PID:1792

memory/1792-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download