5aa1684f63de3ee8ad1a843306c76412f944dff4f962633ddc5eefbf3f9af1f0

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:51

Target

5aa1684f63de3ee8ad1a843306c76412f944dff4f962633ddc5eefbf3f9af1f0.dll
Size

168KB
MD5

0503b788c188074a8298df4142cb332d
SHA1

b6ae7de741d9bdc2b0388ac8e1db032ea75f9d17
SHA256

5aa1684f63de3ee8ad1a843306c76412f944dff4f962633ddc5eefbf3f9af1f0
SHA512

654b641244de830d1e4582acccbac024087607dcba4bca8006fea0184c1859e302b6c3cddc34c6511edc916e2430d1ca04c57be2e91597fe555756755a305c6f
SSDEEP

3072:Qwl30Uz5q2d+vUMBZQgzzn2jAQ3QveTWvyeTd25cDMXAu9BTnARsgMlJqI5UwJEq:QwGuEUmye2AWCvfTdrMXx9BTAanbH+wJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27
PID 1940 wrote to memory of 2032	1940	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa1684f63de3ee8ad1a843306c76412f944dff4f962633ddc5eefbf3f9af1f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa1684f63de3ee8ad1a843306c76412f944dff4f962633ddc5eefbf3f9af1f0.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x00000000001D0000-0x00000000001FA000-memory.dmp

Filesize
168KB

Download
memory/2032-57-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download