ac99b1d6fa6746b9a2e89f404e88a7fc249daf9cda5bb1f1639371cd36379237

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 19:08

Target
user.dat.dll
Size 516KB
Sample221222-xs7ptsac21
SHA256 ac99b1d6fa6746b9a2e89f404e88a7fc249daf9cda5bb1f1639371cd36379237
MD5 e351d66cd0103864d9fdb439a451b253
SHA1 d1d9c420c4b06e33f4bd8b84f740be04db035fc4
SHA512 002c853352a06868d0a9b0201ee7dfc5e83b201c48d85bb7914f3e314012256129a752d8b05829074ee3364656a2c239f5eae0105c3597a432f89961b6d7bb62
SSDEEP 12288:+ihnctArBgRprvbiIIAuz19n26pmpmlCO:HnqAyprvbiIIAuRUmxf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28
PID 840 wrote to memory of 1720	840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dat.dll,#1
  2⤵
  PID:1720

memory/1720-55-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Download