56db7c4aacb5561fcf86e6b5d326d379d0f479ff1c6834afd8174678b787e3bb

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:43

Target

56db7c4aacb5561fcf86e6b5d326d379d0f479ff1c6834afd8174678b787e3bb.dll
Size

57KB
MD5

4653b1e0fd76bc690a788487f3c67980
SHA1

3bc9502f79e6c366d291f1c9f408775f3d70204c
SHA256

56db7c4aacb5561fcf86e6b5d326d379d0f479ff1c6834afd8174678b787e3bb
SHA512

4fa3029be7daab09e98a21a68853f807dd7eccc45fc051e74bda1d4f01fe467caf2fc724ded79862bfb0d7d6a1b5b7e7c72ea68a8b290052fb5e11b8ecba2789
SSDEEP

768:nbY4laRDl3/z7rN6sym2JWKmUNMfaAYk9MmsynNchB1z02LEqSHwic9JgpW+VP:EG2FDgCu33Hbhmsyn6LHLEqSG9YWuP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27
PID 1732 wrote to memory of 1788	1732	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56db7c4aacb5561fcf86e6b5d326d379d0f479ff1c6834afd8174678b787e3bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56db7c4aacb5561fcf86e6b5d326d379d0f479ff1c6834afd8174678b787e3bb.dll,#1
  2⤵
  PID:1788

memory/1788-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download