45c106efcb00b0701b0262f9f3ee2c89c7c4ac5ac68d98fd51a2d9c0795e12a2

Analysis

max time kernel
21s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:34

Target

45c106efcb00b0701b0262f9f3ee2c89c7c4ac5ac68d98fd51a2d9c0795e12a2.dll
Size

103KB
MD5

2ea98e68f6b33c0f0938f3beafeb7c33
SHA1

f4272ca25c2877ff6459c674fd11bc51abf229f4
SHA256

45c106efcb00b0701b0262f9f3ee2c89c7c4ac5ac68d98fd51a2d9c0795e12a2
SHA512

d476cf40f4d2fc3a3c63d7f906378c66769217f9c8f936168842d565f085e816794da37bbd1c9914ff3469acdada0d7e4a9f801ae4eb5ecb7a6665f82eb13d81
SSDEEP

3072:+aXlrqPodl4ynXlwGul8QJ4fFVdGkKHBPc:+aVOAdd3u+QWvdjJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28
PID 1208 wrote to memory of 1428	1208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45c106efcb00b0701b0262f9f3ee2c89c7c4ac5ac68d98fd51a2d9c0795e12a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45c106efcb00b0701b0262f9f3ee2c89c7c4ac5ac68d98fd51a2d9c0795e12a2.dll,#1
  2⤵
  PID:1428

memory/1428-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download