ed66ade5449e891e6124b2827ff45eb04dd025aa04522851c0658b36f5659196

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 02:53

Target

ed66ade5449e891e6124b2827ff45eb04dd025aa04522851c0658b36f5659196.dll
Size

83KB
MD5

6ad8bcfce7f54bb3a8c55847120d5aa0
SHA1

f65bcb2f9c9294c54adef34408554c840b26cfe1
SHA256

ed66ade5449e891e6124b2827ff45eb04dd025aa04522851c0658b36f5659196
SHA512

9e7afae8db4960e6d2e11e5da34971c9b69449f9d37c849812440b880ca6024a6d54d3ace972d5ae9990b548c54d579de1d2cecb87b2f2378947b0381e21945e
SSDEEP

1536:wexh2pSSDXSUNKTeDvZ6GSI48/xRnDTTOLL8TeTlg+:zxokcXSUNKTgchc/LnDTTOLKeTq+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21
PID 1980 wrote to memory of 1968	1980	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed66ade5449e891e6124b2827ff45eb04dd025aa04522851c0658b36f5659196.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed66ade5449e891e6124b2827ff45eb04dd025aa04522851c0658b36f5659196.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download