042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:51

Target

042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll
Size

5KB
MD5

34eb85e4be00254d4536729df626d345
SHA1

972dfbbe924fec1137629504b0b24b4f864c2b4f
SHA256

042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523
SHA512

4ee2d8094c653db522490a0c31fb21347447a8c43027f3057928f1989ddcdc01701f2e822ee52ca203c312c3e3702121b50bf80c9462241df222742e6bb33830
SSDEEP

48:Ss0vOiamaF9wJqkECrhWR00scqn6dFH6pd0n7+uhRS9XTp1mW:z0I9wZLrY0/aH6pOn7XSJV1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll,#1
  2⤵
  PID:980

memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download