7138e13c0cc8ff5dbf6dbc96e048615f5b264ab739db8f8562c29b9caab90ef9

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-02-2023 19:18

Target

7138e13c0cc8ff5dbf6dbc96e048615f5b264ab739db8f8562c29b9caab90ef9.dll
Size

64KB
MD5

53993003f6500d7afcb3eabbe4edd215
SHA1

8ac262736bf0c6ad50273c199b27cd95d0c9fca8
SHA256

7138e13c0cc8ff5dbf6dbc96e048615f5b264ab739db8f8562c29b9caab90ef9
SHA512

294c0fd86a6f1a2f17b5cd64d35186ad64838e0c06ebf4ed6f2416e547edbd7c7d7954cabad8d571f7079165d62c2b521c98167b2a4aa59af4bcfdde1d2ce41c
SSDEEP

1536:XA/BZVk/Nvv0xLe4dOo/IGgQ8RFtsYbsLlWKnw:XcXVk/VvcZtEt3bsLn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7138e13c0cc8ff5dbf6dbc96e048615f5b264ab739db8f8562c29b9caab90ef9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7138e13c0cc8ff5dbf6dbc96e048615f5b264ab739db8f8562c29b9caab90ef9.dll,#1
2⤵
PID:1700

memory/1700-54-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/1700-55-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download