9ee1751933e650c33c68b8ce44a2a0efac9c29baad84ad68dc68255e4a73c949

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 14:18

Target

9ee1751933e650c33c68b8ce44a2a0efac9c29baad84ad68dc68255e4a73c949.dll
Size

46KB
MD5

f9b28f14285825ad95f08238df4981b4
SHA1

1a7bdb0bfa9158190a70ca9636adce8b5e5c2567
SHA256

9ee1751933e650c33c68b8ce44a2a0efac9c29baad84ad68dc68255e4a73c949
SHA512

d3e564fb68f66c1d09a645ac5e5d48d402de510b26537b0d61fcdbc2240f0f1de298b6b5a3df17730161a81de75ab5413047d6120689d13c0e1b250044780a07
SSDEEP

384:lGZPOxCx7UjYN3tGdDGdhv9+/OBmDGj9+/aMhHVs:0ZtUj+dGdDGdhMOkDG4aMhHVs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28
PID 2016 wrote to memory of 2028	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ee1751933e650c33c68b8ce44a2a0efac9c29baad84ad68dc68255e4a73c949.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ee1751933e650c33c68b8ce44a2a0efac9c29baad84ad68dc68255e4a73c949.dll,#1
  2⤵
  PID:2028