122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:39

Target

122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll
Size

71KB
MD5

460a61b2d590070d3615fbf4cc3849d8
SHA1

19a6b57b68623c1183443c40bbfec653f7689091
SHA256

122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551
SHA512

37adc6c559625e75cb34b62bd01bc5d62ea028bd08c654bd1bce52c95929eecf5c8f2f76786f99148b46f93ba752fc31f339167b3c0422ac871f29c93e11aec9
SSDEEP

1536:9HF3cPoVBuSRqcNWjk9hV4o7Av9BDOcuC3UVj8:/3cPoVBPRjNWg7io7AlBCVC3UC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download