5ae1048ba3ffb815fce41549d16e0fa9505826c8155c7c14d1a6d16d099206c2

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:00

Target

5ae1048ba3ffb815fce41549d16e0fa9505826c8155c7c14d1a6d16d099206c2.dll
Size

69KB
MD5

a1d7b49d1dbf78fbb25faee4ff5b1f8b
SHA1

8756449f524e79de7f164069e094e81ba620b8a4
SHA256

5ae1048ba3ffb815fce41549d16e0fa9505826c8155c7c14d1a6d16d099206c2
SHA512

2febb316b4ead63f4f5ac5d4f478aec2a7d989b8bfb4e79c41edeb35c3e31fc1e366b4bbe4498b13b1f32669a7a6531c9cef7546c07e21b3ba5583573f858d71
SSDEEP

1536:1zExMwCGQ2jOMlBAf2DmSca1Xv2xoFg+XneF3a7QGhmqCm1J1OU:1I+wCGvqMfAOCSd1XeaFjOdaLhvCmz1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae1048ba3ffb815fce41549d16e0fa9505826c8155c7c14d1a6d16d099206c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae1048ba3ffb815fce41549d16e0fa9505826c8155c7c14d1a6d16d099206c2.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download