38c740541408f92792d9369be8451a8b0b266f2a478d1ecb1082289da142397e

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:49

Target

38c740541408f92792d9369be8451a8b0b266f2a478d1ecb1082289da142397e.dll
Size

4KB
MD5

046c59456ff6caf14fe92bc787ef970b
SHA1

6acdb489b482da36f32ad28d5b526905fa93c7e8
SHA256

38c740541408f92792d9369be8451a8b0b266f2a478d1ecb1082289da142397e
SHA512

394fc6b228b7e0c1e090207c525e0c3f13e41aaa944e3f080a2478d16077929bd14b8866610827c12dfc6539bd2e784225f54e42ce3d7cf6355efa6d282c256c
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKpRZZH5fKnmh2D4yqCDJ4yXr7XP:PT3r2vu9gZH8na2UnSRXXXP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c740541408f92792d9369be8451a8b0b266f2a478d1ecb1082289da142397e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c740541408f92792d9369be8451a8b0b266f2a478d1ecb1082289da142397e.dll,#1
  2⤵
  PID:1744

memory/1744-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download