a50dd187cfaa0dc82a59398b23e9dc377f5d794b511008b3f714488100545543

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 15:49

Target

a50dd187cfaa0dc82a59398b23e9dc377f5d794b511008b3f714488100545543.dll
Size

5KB
MD5

6bf9db3ebb660b1d8527fad5a6e0bb52
SHA1

3d1ec6c289f3d1e537d3d3f0f686f43efd40732d
SHA256

a50dd187cfaa0dc82a59398b23e9dc377f5d794b511008b3f714488100545543
SHA512

e781e277dd9663efa1a1321bbb9f64b871da535bd95af61414b65bafb5d4cfeefcf147225b0e3f5ae8096ea9352267b0a4b922691b6e8d33a77a8e5a9a702802
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKTEOgWOIU4qgKMagbVbL48u09j6FwKBUFbQ7tMy3:PT3r2vu9Ug+5V5KBUctF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a50dd187cfaa0dc82a59398b23e9dc377f5d794b511008b3f714488100545543.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a50dd187cfaa0dc82a59398b23e9dc377f5d794b511008b3f714488100545543.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download