6d2fad48580121f84c664135559f6eab88f926d532896f89e078de0a0d06a3f9

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 19:43

Target

6d2fad48580121f84c664135559f6eab88f926d532896f89e078de0a0d06a3f9.dll
Size

52KB
MD5

5bc1c4ef1d847de7fbc926a6ac8db576
SHA1

862cbae563e4d88d1af08844f9f4fa2dc52f5615
SHA256

6d2fad48580121f84c664135559f6eab88f926d532896f89e078de0a0d06a3f9
SHA512

c9c24835dff7ea74ce5d5d913fc4a15cc37634bd4d9e82a9e6909ea7e2b1a9d4d88dc2c3264cb0c7ec27a560514307ea0904b19d52f3a58518e76b765f5203ee
SSDEEP

768:QL6ZC0S5paGQ6yfLsa6QByqRYQorthXyvDoNLj:2EC0S5RPyjsa6Qb+QophXyvDo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28
PID 980 wrote to memory of 2028	980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d2fad48580121f84c664135559f6eab88f926d532896f89e078de0a0d06a3f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d2fad48580121f84c664135559f6eab88f926d532896f89e078de0a0d06a3f9.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download