869c04bf14e9afd1e702d0890b7aae7a42e106e8b0096238522e382f3ef25279

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 18:55

Target

869c04bf14e9afd1e702d0890b7aae7a42e106e8b0096238522e382f3ef25279.dll
Size

29KB
MD5

49062d6d6aae51d6facb7c367f69fc1e
SHA1

a6dd3eca84d14a9e23e785218b89d1b0a94a71fd
SHA256

869c04bf14e9afd1e702d0890b7aae7a42e106e8b0096238522e382f3ef25279
SHA512

8660914ee7eea0c805fe229b40afe2732737155602ec5e319302b173f9176284b6e5a447b20858b55135a88b978cf6e5947a67950c9197aebf09b4eb35f3b38f
SSDEEP

768:OS6QFRgH+gAusIaL5o3746WBG7xObPrVpfoh:OIRgeggW46WBP6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1992	932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\869c04bf14e9afd1e702d0890b7aae7a42e106e8b0096238522e382f3ef25279.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\869c04bf14e9afd1e702d0890b7aae7a42e106e8b0096238522e382f3ef25279.dll,#1
2⤵
PID:1992

memory/1992-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download