d75da51c4bc3cb6b81ae25ed0f432e525963f0542b5abf07443764d19fa533cd

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 08:49

Target

d75da51c4bc3cb6b81ae25ed0f432e525963f0542b5abf07443764d19fa533cd.dll
Size

63KB
MD5

6ae3ba56e1fd0994460dbcba0e5830ac
SHA1

1aa14fcd995df2cce5143ef0a3ba4267b7f75e8f
SHA256

d75da51c4bc3cb6b81ae25ed0f432e525963f0542b5abf07443764d19fa533cd
SHA512

8da9b75138dd4564b8f86af670b31515612a2309e43670bd712f16d3b56312512f48246c40caecb49772df7966752328f291055dc002b5cce72cf35893f69472
SSDEEP

1536:Bm1NGJVGlu0t0xW+WwsGZy4QnLhyWcHDzPKbpt:kX0V3WyS9HcHin

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28
PID 1728 wrote to memory of 1980	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d75da51c4bc3cb6b81ae25ed0f432e525963f0542b5abf07443764d19fa533cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d75da51c4bc3cb6b81ae25ed0f432e525963f0542b5abf07443764d19fa533cd.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download