5662608a3f63f29acd59c7b2ac9d0a361e7d012316dc8746eb196ddaeca2d79e

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 12:49

Target

5662608a3f63f29acd59c7b2ac9d0a361e7d012316dc8746eb196ddaeca2d79e.dll
Size

19.5MB
MD5

3ff55447501036f7cbffde8ddd97a993
SHA1

f5cfc4f46a682ec0d8f74ef39d4be895b13300b3
SHA256

5662608a3f63f29acd59c7b2ac9d0a361e7d012316dc8746eb196ddaeca2d79e
SHA512

f9f55163db80be0542314013556ade818aa4ed3c5ca66dce1d1e4c57acb06b710cd091d7dcb3806d6fcf5834d4a4af607a72af324d0a0cff0684d5b18a81eefc
SSDEEP

384:+2y6K867Tn9i6+Xiyo07PEWUJOoH8HoI0I/YD/tuSAPcWPno7gULnYHK6:H967Tn91+SjXQoHy7YD/tiPnoih

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	rundll32.exe
1220	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5662608a3f63f29acd59c7b2ac9d0a361e7d012316dc8746eb196ddaeca2d79e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5662608a3f63f29acd59c7b2ac9d0a361e7d012316dc8746eb196ddaeca2d79e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

memory/1220-54-0x0000000000000000-mapping.dmp

Download
memory/1220-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download