2f3535b40504875f3a95b74af5b53e561020a3018b7ccb12f4f2388fc6886792

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 10:37

Target

2f3535b40504875f3a95b74af5b53e561020a3018b7ccb12f4f2388fc6886792.dll
Size

4KB
MD5

66eba2882b63741fa3e2ceff6435872d
SHA1

cce7e1ebc0e8096b1ba93225a1b09b4bddea8317
SHA256

2f3535b40504875f3a95b74af5b53e561020a3018b7ccb12f4f2388fc6886792
SHA512

c20c43dec9ae9833ad157ac80194b8df4b4504baed8325580ca6d241e928abd8dd572f0fb22e6dbf752601bc444504cd7a9bf7a52538c842a3aef1e31b0a32fe
SSDEEP

24:eNGS5k4V4s3Ce89XF/QPVGRVtY44MBgCF1ri1/pNvxZu7cwVIaHYRXcs5o33JOIW:a5zdM1cSTBg0r27vTuAEKa3JcEOQ5G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28
PID 1240 wrote to memory of 1720	1240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3535b40504875f3a95b74af5b53e561020a3018b7ccb12f4f2388fc6886792.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3535b40504875f3a95b74af5b53e561020a3018b7ccb12f4f2388fc6886792.dll,#1
  2⤵
  PID:1720

memory/1720-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download