400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 17:19

Target

400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll
Size

124KB
MD5

66a8fad7f885dad96aeaaf4dc46f9480
SHA1

5758208c21f85338f6c0d60952aedea90615c394
SHA256

400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee
SHA512

f78e859c862c322d1f7d5e44f0b6d080f3a74c4ce7ee3f38c958e8028cb6ec466c79bd610daac20e3b80e6cea1f6e41f31dc2bf05e71d1100130958494762477
SSDEEP

1536:ts+jlkPBfHtSkYoPPgC31dZj5RGIsINXIBIuIJkuvfZ/AuwWnFJy:1EBNRYoPPgylG7KuNyxvfGWFJy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll,#1
  2⤵
  PID:1712

memory/1712-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download