4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 02:22

Target

4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll
Size

73KB
MD5

5e5209396c37957e9be9a20103db606b
SHA1

32d0619cacf0484f35100b35058889bcfcc4745b
SHA256

4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c
SHA512

4c95f9bf86ee5317deccf48c787d044257e2a9f60a5370f7939e46aef60d977890d8ff16dd6dcdad295445d7bb6eb4716370fd047cbe34d659837c0ae16fd4b5
SSDEEP

1536:Frm4jQ66HFAvGFb7e+MkAWQ0NoYhobUo9+v95TrA2UEe4Z8E4yqyot1E:tm0yGm+gAWQ+hHokF5Y2UDi8E4yTot1E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#1
  2⤵
  PID:548

memory/548-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/548-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/548-57-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/548-58-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download