5737946252b4b16e9cf98f9f291a1a47ca7075e7e815f37cc96efbe33947f329

Analysis

max time kernel
44s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 10:53

Target

5737946252b4b16e9cf98f9f291a1a47ca7075e7e815f37cc96efbe33947f329.dll
Size

70KB
MD5

965c83491ff5682777b248f40b3ae48d
SHA1

0bf05dc7c746d40264055cf206024ffd2778cb0d
SHA256

5737946252b4b16e9cf98f9f291a1a47ca7075e7e815f37cc96efbe33947f329
SHA512

4493a0afd6802db4dd855b98a536aa40d3d2548326200102f1e5457b60007a8ce621183e9aab638be1942e43fa6f4ac23966b03b19c8ee36ee15131a71aa3e63
SSDEEP

1536:KHgxEh23vYo9I8n4Grc3FKtII20lPIsZCN5hG2KIL9J:KHj2vR9Rb+FIIInC1R

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5737946252b4b16e9cf98f9f291a1a47ca7075e7e815f37cc96efbe33947f329.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5737946252b4b16e9cf98f9f291a1a47ca7075e7e815f37cc96efbe33947f329.dll,#1
  2⤵
  PID:1228

memory/1228-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1228-57-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1228-58-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1228-59-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download