8688b069f1a4467b3f278d11f7fd968d8f241e74246631cf38349ffc98ab9c62

Resubmissions

30/03/2023, 12:38

30/03/2023, 12:29

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/03/2023, 12:38

Target

9ca48d49a500acadbdf5832846f904187bd4952e25559e8de3d1209ffba4563b.dll
Size

5KB
MD5

c042116ce24984f722f8aa9b6e17c405
SHA1

d4e3288732d55274aba43560044fc61f9d8c22b7
SHA256

9ca48d49a500acadbdf5832846f904187bd4952e25559e8de3d1209ffba4563b
SHA512

80806566cc89f10e7fd72fef25d6ffaa127e406df3abc7ffa1dd8c81cd04c102677d8fbb5a53d63aa02b30bc44b38285fbbb04edae4f6bbe54db955f6d22c1ea
SSDEEP

48:ZAa464sWtq2ANGLjnGVO0PQ7OrmG0gbCI8:Z5joq2mGLbGFBr30gbC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca48d49a500acadbdf5832846f904187bd4952e25559e8de3d1209ffba4563b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca48d49a500acadbdf5832846f904187bd4952e25559e8de3d1209ffba4563b.dll,#1
  2⤵
  PID:1928