49b538e4fe4f071852e8ec66a101d3e527549e7f75e44c5c9a5cd140281896c0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 06:06

Target

49b538e4fe4f071852e8ec66a101d3e527549e7f75e44c5c9a5cd140281896c0.dll
Size

18KB
MD5

7b2a2fd19025078bba86619576178dc1
SHA1

97777946ba5390caa1162faa9d6ef074648b66ff
SHA256

49b538e4fe4f071852e8ec66a101d3e527549e7f75e44c5c9a5cd140281896c0
SHA512

0c5149272881948b237616bae65052869b5994312914d9250e3a992c30e966d2cee323715ed4385ad8045f6dc44059a0386fd4d0d84af187d7c5a0972f2d74fb
SSDEEP

384:/R/jHVeeLfgPqc+urDZRQcNtVg+T2a9IXXiKKi:J/zV7kCBuffg+ia9KXnKi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49b538e4fe4f071852e8ec66a101d3e527549e7f75e44c5c9a5cd140281896c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49b538e4fe4f071852e8ec66a101d3e527549e7f75e44c5c9a5cd140281896c0.dll,#1
  2⤵
  PID:820

memory/820-54-0x0000000000000000-mapping.dmp

Download
memory/820-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download