56b16a96c5c3f4e5e784411f4879267026ff820e6c966830e53e46cdfc2eb540

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 10:41

Target

56b16a96c5c3f4e5e784411f4879267026ff820e6c966830e53e46cdfc2eb540.dll
Size

7KB
MD5

810fd4be09c0d66f9c824fbf9567b504
SHA1

d0e0e16f8ff14283ebaa89ed167cd2eca9232d21
SHA256

56b16a96c5c3f4e5e784411f4879267026ff820e6c966830e53e46cdfc2eb540
SHA512

63214617e87317cda05ec366761541a3ccbe6c14ffe400e3844962c2486bf1d4db0882b32d8de9a6a98d99d34f58abc31eacc41dc6086e92094c5a3d5c2c4486
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROfw69uyiPWEZNUIhXZuQoinEa:YXKwfy1EZNxZ1E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b16a96c5c3f4e5e784411f4879267026ff820e6c966830e53e46cdfc2eb540.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b16a96c5c3f4e5e784411f4879267026ff820e6c966830e53e46cdfc2eb540.dll,#1
  2⤵
  PID:1128

memory/1128-54-0x0000000000000000-mapping.dmp

Download
memory/1128-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download