9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:37

Target

9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll
Size

54KB
MD5

e7d3b97c322e75d64ce11538565c9dfd
SHA1

9931b0aa18519bafe9cbab527dce30a937961e51
SHA256

9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9
SHA512

2e9a0390684371f6584ab0b247ae8582511d649aba3136e43c820f519d6089465cb3c05e303137cc3e3ee9849d88d1f34400cb5b992c90db81359b30e5ad75f7
SSDEEP

1536:7k876xSRHGRHQSFIh1yH0jKDKNoUqGGOLaNvSp9:o87sSRuwSFIrw3OBf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28
PID 1128 wrote to memory of 268	1128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll,#1
  2⤵
  PID:268

memory/268-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download