608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:40

Target

608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll
Size

64KB
MD5

60d79fa0aa3567699ced81d8dd07b060
SHA1

14cdbbf93409c757f0827bb476fd1ad3d6da1015
SHA256

608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330
SHA512

6f127eaa1563cd474b176c46af16bb5e43dec92fc49261caa68e924279984c87d5a169cc0d2f9d7f868e6f839189f14808ee3926bf3d8590903311de0178e3d3
SSDEEP

1536:ob8Vwn/JzagaQDqKQs4DcVWPBPjrB3kF+Wqvf:oz/JfmsocVW5PBkFPqH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download