01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b

Analysis

max time kernel
15s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:12

Target

01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll
Size

52KB
MD5

97563553c568371f5e4463e54d3dbb92
SHA1

cddea55358a691898345cd47d28278a3141076b0
SHA256

01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b
SHA512

487149039b8bea5e94502fac36250024ce4feb8faece5222a710c00fd068ccdbc53039ea5e6aa7ee6668e513060718c537346e0d7610f1603e12caac954ee823
SSDEEP

768:U0GSzLRUzag7m5dlX/rq94Erj/hhhL0AR1nJyN9uXo9o:U0GShKaFW4m/hhl041n47So+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28
PID 1724 wrote to memory of 1708	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll,#1
  2⤵
  PID:1708

memory/1708-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000001D30000-0x0000000001E06000-memory.dmp

Filesize
856KB

Download