11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-02-2023 19:47

Target

11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll
Size

170KB
MD5

2d63fa2cb2aeb06ed0c1d748c29962cd
SHA1

9911e414f09e4cf3939356b6e85f9d9fcbd68adf
SHA256

11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e
SHA512

d83e43187b62a98057f1afb13ba7041f488f66e1608c7092c773d6138ebdfcf36b54e3a48d6bc65178f84e6e0a675b2c74b7f823e62b876930af4932545fa985
SSDEEP

3072:j/OJcXyZH+ZLa+W1icfTrYZwfr3rkw3HdQR8hVlkddWrD:zC9+daj/QAr3wOCeVkGr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1692	1580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll,#1
2⤵
PID:1692

memory/1692-55-0x00000000001A0000-0x0000000000205000-memory.dmp

Filesize
404KB

Download
memory/1692-54-0x00000000001A0000-0x0000000000205000-memory.dmp

Filesize
404KB

Download