5f46d94c6e8d8a840eb2fc21c9e089e065cd336b69a9fb979a92ab660ea03b3b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:26

Target

5f46d94c6e8d8a840eb2fc21c9e089e065cd336b69a9fb979a92ab660ea03b3b.dll
Size

73KB
MD5

7a48a358f23d01fdabda0927d2dd907f
SHA1

745aeba321fca21322d7ace072e4a684cbec08ce
SHA256

5f46d94c6e8d8a840eb2fc21c9e089e065cd336b69a9fb979a92ab660ea03b3b
SHA512

1315f3af442b88b007f9034abda8bb7fc986dbbb5dc83fcf6d84420a1eadc7cb81e47c15a3aa807f89687ef1d15e2d0409aba31ba6c2619c009200c50623e3cf
SSDEEP

768:IWoFNB0PguXqDoaALH1mexy3qrihr/xNS:Do2PguXB1VmKyaJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f46d94c6e8d8a840eb2fc21c9e089e065cd336b69a9fb979a92ab660ea03b3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f46d94c6e8d8a840eb2fc21c9e089e065cd336b69a9fb979a92ab660ea03b3b.dll,#1
  2⤵
  PID:1324

memory/1324-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download