b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 17:15

Target

b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll
Size

16KB
MD5

9df007ba65ceb5cc5cd2c5c01e5c25a2
SHA1

7b4339e78be96dbdd83197834cbdac28ad34768f
SHA256

b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134
SHA512

7aec552c86fe564856ed6aecbed32729d659c44dfb0db6acf5691d9fa3ee67ea9d1c7f39175c2012a90f8a688c01c7227a0bce6c048e31600e8c153b7c5fc386
SSDEEP

24:e1GSgDSEhTCglIB6SXvVmMPnTjvhBrDsqZ:SgDNllVImgTNBsG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28
PID 1720 wrote to memory of 1212	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll,#1
  2⤵
  PID:1212

memory/1212-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download