9fbd121b9c7251c4c026d97c47dc4dd3db2d5cd76cb83316fcc363f26e064ffa

Analysis

max time kernel
43s
max time network
93s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 13:58

Target

9fbd121b9c7251c4c026d97c47dc4dd3db2d5cd76cb83316fcc363f26e064ffa.dll
Size

168KB
MD5

c6bd4936da1b474ee7d7a1daff62e364
SHA1

429e8257ec6e12f4d31637d811e12d1bae97ebb6
SHA256

9fbd121b9c7251c4c026d97c47dc4dd3db2d5cd76cb83316fcc363f26e064ffa
SHA512

261f648205787e347d977a4cb8ce14d822a15abe9a6e13eddc623b0502c9a3a480e943438ac0609a7d0bcbcb167b16b2930eda952c97d8cc01997facb1679972
SSDEEP

3072:SgSzQ8mWWIEkC3fvOkVAMJL5lyJHTBfpw8O/ya3v:vjDtT33OkmMJllOHTBhwH/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1652	752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fbd121b9c7251c4c026d97c47dc4dd3db2d5cd76cb83316fcc363f26e064ffa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fbd121b9c7251c4c026d97c47dc4dd3db2d5cd76cb83316fcc363f26e064ffa.dll,#1
2⤵
PID:1652

memory/1652-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download