5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 17:51

Target

5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll
Size

98KB
MD5

04c2c7b87b9a9315d86ac6cdd369e790
SHA1

c8b04747a833a9a3d4364ddf9b0c6dbf51828d34
SHA256

5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d
SHA512

8a3684201e3d566fcaa8b4f1fb7e0e2a8c3268cfa2fcdddf43afd547518417d05e2c2285672cd5d15ea270488d8251978e137a537e8cfed0e2472c02ac96cfa9
SSDEEP

1536:vzYcGYquNQUXaZx+el1w4oDcR3/unZhcXWwiskd1O7x+WmhiLPGHGqTLO23:lQuaUuDuDcRWH0oskyUEDpql

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28
PID 1404 wrote to memory of 1956	1404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x00000000611F0000-0x000000006120D000-memory.dmp

Filesize
116KB

Download
memory/1956-57-0x00000000611F0000-0x000000006120D000-memory.dmp

Filesize
116KB

Download
memory/1956-58-0x00000000611F0000-0x000000006120D000-memory.dmp

Filesize
116KB

Download