da57b4c8c792c09c247e7002a6fac9c57dc54e46ad1504fee1b0f0b1eb21d75e

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 01:03

Target

da57b4c8c792c09c247e7002a6fac9c57dc54e46ad1504fee1b0f0b1eb21d75e.dll
Size

5KB
MD5

67510572e271c6150fb2989fa4a16f60
SHA1

a043911e691a1c8da77592c0c787daed42eb74b9
SHA256

da57b4c8c792c09c247e7002a6fac9c57dc54e46ad1504fee1b0f0b1eb21d75e
SHA512

810239a411982649f1b08559360aebfb9fe7e6a866fbf13b3e4a9292c3ec206c649f33e4b26c76ed87ae612322b969e1b10cbeb4f7b46c628c129cd799c61d97
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9Mgdtb8Vdgubg6dgcexloeI1tMHfZUn6cQ:nI2RrUeqI1tMBU4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28
PID 1672 wrote to memory of 1164	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da57b4c8c792c09c247e7002a6fac9c57dc54e46ad1504fee1b0f0b1eb21d75e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da57b4c8c792c09c247e7002a6fac9c57dc54e46ad1504fee1b0f0b1eb21d75e.dll,#1
  2⤵
  PID:1164

memory/1164-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download