0fb335964ff11791e61786afafb6b8695f5db4a80eefae58a1b9ba590c39632c

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/12/2022, 10:17

Target

0fb335964ff11791e61786afafb6b8695f5db4a80eefae58a1b9ba590c39632c.dll
Size

402KB
MD5

9d9dc338c229befc48952d665b7414d6
SHA1

1f179fd735bdcd8432b842f6e99a3bc7a24d12f7
SHA256

0fb335964ff11791e61786afafb6b8695f5db4a80eefae58a1b9ba590c39632c
SHA512

7e048651280e4d47017ab09c01badc79191b209d1371ddba2dba64019eed87313f1c9fb73f0278da93d9e7a6e4f03d5df3baef980926ca62b828a0ad4795b30d
SSDEEP

6144:KjQYoi2EXPuQfZQrIujs+ZiGIdfUhvg+4ZfWsJ:+zPuQfZQr5iGoUk+sJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28
PID 2008 wrote to memory of 2028	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb335964ff11791e61786afafb6b8695f5db4a80eefae58a1b9ba590c39632c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb335964ff11791e61786afafb6b8695f5db4a80eefae58a1b9ba590c39632c.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download