e56ba81a9611616b3dd3be22f04dac0710f7503e6389e18bba02f835fb6a35d5

Analysis

max time kernel
33s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:08

Target

e56ba81a9611616b3dd3be22f04dac0710f7503e6389e18bba02f835fb6a35d5.dll
Size

77KB
MD5

58ffe460c3471d14839cdd26746f2e70
SHA1

b806eb3e0ee0db0336a75fc57cd4d71adfd9aafd
SHA256

e56ba81a9611616b3dd3be22f04dac0710f7503e6389e18bba02f835fb6a35d5
SHA512

6a7151ed360d8a6e07778b7ab58b6cd18e1f91b8bcde2f5ab73f2b114ea0f4c0b46e70e35cdadb93f2c7b7491caee495681a3dd88b2edb1e417796dc31e6cab7
SSDEEP

1536:nkb95L266MC4mTm/stBfc8vsWjcdDRkbVqq:ng36JhQDRkbQq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e56ba81a9611616b3dd3be22f04dac0710f7503e6389e18bba02f835fb6a35d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e56ba81a9611616b3dd3be22f04dac0710f7503e6389e18bba02f835fb6a35d5.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download