fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:15

Target

fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll
Size

88KB
MD5

1681cf0edc59af8f1fe0155e93f679a6
SHA1

504142c58bb45f8aa92f8df7aaeb11dc48e894f8
SHA256

fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213
SHA512

2cf7b2dcd54adf3a769389158d1de3c009d27257f58dff4e36f404958343bee97ca5a09f8987a6b84fc6d8a718b8ab4fa89e0d5ea9d7455060a7291b1be9f23e
SSDEEP

1536:glhnOnTffp438lQa55lFrgRtd8s+PslzUr+o+7himGqksTa3Aa55lFLa55lFFGl+:2hnOnTffpeMRlgRtdYUpwZCimGdxOmCD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download
memory/2032-57-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download