96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:43

Target

96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll
Size

58KB
MD5

50c169f3cb3d59f44d68bd3f2d28ad30
SHA1

8e7caa5958a0a33a98d58c5d56cb7a967845ea46
SHA256

96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d
SHA512

b9f327c1f5f20b2a52fb789db1abbb149f33fe3c6b37bb9d6b26aec314b50d4c69d90beb2a6bd5134d9eb45121f647b484751301f8652371cf342f2eef7b4954
SSDEEP

1536:yl3E0T6iMZHUxtjyxsLRZ6+GKps+fO5F19GE9J7s1P:E39x20x0xsLRXCB/Ji

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download