2a5d51f5fd0c4960163be6501f591f228da9063530f2e0a4a7911008ab2b7db0

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 22:41

Target

2a5d51f5fd0c4960163be6501f591f228da9063530f2e0a4a7911008ab2b7db0.dll
Size

32KB
MD5

d01e46f5c1ab79da753323bf86bb7497
SHA1

815274074aa0948ea04ba35f60e3be31ad59e5f3
SHA256

2a5d51f5fd0c4960163be6501f591f228da9063530f2e0a4a7911008ab2b7db0
SHA512

ca38c08a046322298907ac1a32f4bfe997ca3901b5d9787074a4dcb7d15cb82b5cc1fcf232908ba7783c581918ea5e30b77f56c793ed0988ad0ef20a9909916a
SSDEEP

768:mDxt1Ri/nlTfgrvS5iX/bt7PXTBXvt0OqObytRI+pr5:mDxt1Ri/l5iXZ7PXFXEVRI+pN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a5d51f5fd0c4960163be6501f591f228da9063530f2e0a4a7911008ab2b7db0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a5d51f5fd0c4960163be6501f591f228da9063530f2e0a4a7911008ab2b7db0.dll,#1
  2⤵
  PID:1472

memory/1472-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download