ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/12/2022, 20:27

Target

ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll
Size

207KB
MD5

daa504c1111ff530e69b9d695cecdc86
SHA1

601cb5ecdf3bde2cb40052cf581a8ca4cd14ec37
SHA256

ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65
SHA512

0fc1a3901bff9bbbc8b7eb9be4bf1a997628527a1c75153508db03548a3811085b7e6c4530952d10bc0c4869291b6f07a8d27353cfe9e76620270bc2f3e2d42e
SSDEEP

6144:1jLruYuhKsgErPpaZD38YhbGcLcSflWTBTos65u:1nrbuhKsg8TNoS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28
PID 1896 wrote to memory of 1932	1896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll,#1
  2⤵
  PID:1932

memory/1932-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download