68333c2a3fc1011b4f3d13fd6bbf4c96dd2cedb83e488f17d3b9f6d342674f33

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-08-2022 10:42

Target

400c498959fce30434b980ce660ba2ca6711a91b991d61426f7dcf524bd73582.dll
Size

8.2MB
MD5

a5a58fd9d5106e70e4ce55257a9d16cb
SHA1

a6a892da315d0c29e43cff41d2476c9a6f375191
SHA256

400c498959fce30434b980ce660ba2ca6711a91b991d61426f7dcf524bd73582
SHA512

2a119fd23ec448a79ac9b6aaca64dd7439bfbd1eeddf8b81017c67af720194220b1537640e129ecb1539c40c123f3f45deef026ddb3db39225c372558e664cd2
SSDEEP

49152:xSFzp+JFY83N1qscUGsiLnQgQTClyapNoDkWkm7qcfaJDJkTKE+9y2zkWS:48J1lxGnQhTirpNW6r9DQH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400c498959fce30434b980ce660ba2ca6711a91b991d61426f7dcf524bd73582.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\400c498959fce30434b980ce660ba2ca6711a91b991d61426f7dcf524bd73582.dll,#1
  2⤵
  PID:1460

memory/1460-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download