5cb49636a0d759cf24bd19ce17003a62f1e8d4d076844b9110af8b9172413508

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 21:15

Target

5cb49636a0d759cf24bd19ce17003a62f1e8d4d076844b9110af8b9172413508.dll
Size

164KB
MD5

853ab7bdeecf03306178f4af40eff694
SHA1

ff7b52e2ccf0b4b908af478cb477bc67bae61321
SHA256

5cb49636a0d759cf24bd19ce17003a62f1e8d4d076844b9110af8b9172413508
SHA512

c9f1de2facf37a215ffe580024346a2a5873c2dcd378cf5226bf9631aeebd03a751f51331aa17bf046033d47bcd4309ed761d74fe4567eea0a95571bb5d5a1e6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1088	1052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb49636a0d759cf24bd19ce17003a62f1e8d4d076844b9110af8b9172413508.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb49636a0d759cf24bd19ce17003a62f1e8d4d076844b9110af8b9172413508.dll,#1
2⤵
PID:1088

memory/1088-54-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000075C91000-0x0000000075C93000-memory.dmp

Filesize
8KB

Download
memory/1088-58-0x0000000002F80000-0x00000000030AD000-memory.dmp

Filesize
1.2MB

Download
memory/1088-59-0x00000000008D0000-0x00000000008EF000-memory.dmp

Filesize
124KB

Download
memory/1088-60-0x0000000003300000-0x0000000003409000-memory.dmp

Filesize
1.0MB

Download
memory/1088-62-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1088-61-0x00000000001E0000-0x00000000001EA000-memory.dmp

Filesize
40KB

Download