312284522baab6e752ef9f4d8e865bbaa099a0e4ceb33a504b9b5b8e90bcfc84

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:04

Target

312284522baab6e752ef9f4d8e865bbaa099a0e4ceb33a504b9b5b8e90bcfc84.dll
Size

24KB
MD5

584ab92f70a76643c18cd25fb56c3017
SHA1

c26123bc7a97f613b10c708200ae83b4d0578c01
SHA256

312284522baab6e752ef9f4d8e865bbaa099a0e4ceb33a504b9b5b8e90bcfc84
SHA512

a1d0e53ae86f1e57f13b158cd098a2e5a12e6b99024535fe1e326db11fef413c6ff387e6ead0c46292bbeeb55b985b4a7544886a58faf2955c9654e7a7294491
SSDEEP

192:3sNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkvG:3cG8W59LhtEQA/4O82FV9PS8VkwkvG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\312284522baab6e752ef9f4d8e865bbaa099a0e4ceb33a504b9b5b8e90bcfc84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\312284522baab6e752ef9f4d8e865bbaa099a0e4ceb33a504b9b5b8e90bcfc84.dll,#1
  2⤵
  PID:1396

memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download