8c5379a888c4743c44a190690a84cc5682770d0bceea7a76ab3b3e20dcaf3291

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:54

Target

8c5379a888c4743c44a190690a84cc5682770d0bceea7a76ab3b3e20dcaf3291.dll
Size

59KB
MD5

679ccf27d7a6c4f96ec3da2ad8defd3b
SHA1

41c81ab6e870fa7c573a9c411796ac62064128f9
SHA256

8c5379a888c4743c44a190690a84cc5682770d0bceea7a76ab3b3e20dcaf3291
SHA512

16963e76b39a87df952bbf0065699895457ccfb4c9d81681c74f45e59ef52e396e3a3903b6e19e02d35db6a99fa70c03979e8bc2a21078c1623e0bd745fa90b3
SSDEEP

1536:Cgm4z/jyqiLD1lMmB6V59GhFAMmEobxVn:C7ueqoN64Yoobx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28
PID 1388 wrote to memory of 1732	1388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5379a888c4743c44a190690a84cc5682770d0bceea7a76ab3b3e20dcaf3291.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5379a888c4743c44a190690a84cc5682770d0bceea7a76ab3b3e20dcaf3291.dll,#1
  2⤵
  PID:1732

memory/1732-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1732-56-0x0000000000160000-0x000000000016A000-memory.dmp

Filesize
40KB

Download
memory/1732-60-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download