e45a15d005442786d72da5e456bb2a6ffbb6d6520fb6da74ec91a2a853b1e9bf

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 01:06

Target

e45a15d005442786d72da5e456bb2a6ffbb6d6520fb6da74ec91a2a853b1e9bf.dll
Size

128KB
MD5

744d578042217d02f23c4460ef4af3d0
SHA1

fdfc909dd97ad035f688fabd6c9226e20e800a27
SHA256

e45a15d005442786d72da5e456bb2a6ffbb6d6520fb6da74ec91a2a853b1e9bf
SHA512

039528eb1c1d832c100f5f1d5a6e3da520d8065f8ec1a14cd84d367e5073dab680ca7fc312412bedecd19d1e4bb60705d5f1d7f82a4d52d88cdf32253956277e
SSDEEP

1536:35SjdUA4CTQOiaVTUP0q1mDpdoMQdwNr5Lsqut8kjPPX0Sct3jQWHoOo+PboFuD6:YJUADiae8q1SeMQdqrhkQrroOoEsFuwb

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winlosen.dll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e45a15d005442786d72da5e456bb2a6ffbb6d6520fb6da74ec91a2a853b1e9bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e45a15d005442786d72da5e456bb2a6ffbb6d6520fb6da74ec91a2a853b1e9bf.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1620

memory/1620-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download