05139c28a92576c6bd1f3f831fe3bd7e72900b2425790a981da1339032ff7311

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:59

Target

05139c28a92576c6bd1f3f831fe3bd7e72900b2425790a981da1339032ff7311.dll
Size

81KB
MD5

605122ad6794d8403dc5c4f78a136a3c
SHA1

c6b34bf15cc4ac39927bc83a81b5fe815528a4e9
SHA256

05139c28a92576c6bd1f3f831fe3bd7e72900b2425790a981da1339032ff7311
SHA512

cc4286543637b5ca749ae6358933d228f6e25e9a56b4147f355426c372ec511a5d333131843c07d9de0fe91ec86fb01aae6162b4b706e98978f9675905644666
SSDEEP

1536:LmSQNbJE1vj8gDxkO34WQ9THqvMDhe+c3DLUE:LmFty1L8gDyO34W8HqvWhc3cE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05139c28a92576c6bd1f3f831fe3bd7e72900b2425790a981da1339032ff7311.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05139c28a92576c6bd1f3f831fe3bd7e72900b2425790a981da1339032ff7311.dll,#1
  2⤵
  PID:1672

memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download