23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f

Analysis

max time kernel
22s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:01

Target

23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll
Size

49KB
MD5

4b6d3f24b827ad8232dacc100b27a8e0
SHA1

44d2e57ab512b770ea0c140031f93e081ed46a91
SHA256

23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f
SHA512

51117999e0a2c09c5df6339402af1518e49cb160e0cb31eca60c88988553796e47a3d9b495a200d256753f87192addeae904634d4e30ebe5c865f8afe4da0873
SSDEEP

768:kHwfLvO380aF15GyVj6sR4ufZR09UcCBTXGs4NPVzPCMc8IyM:kQfr0s5rYsX7WuBTXM1PCMc87M

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27
PID 548 wrote to memory of 1756	548	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download