48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 12:37

Target

48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll
Size

190KB
MD5

a002bed4aa3b4da8b287f3963edd02f0
SHA1

720460948af4771ed728696fabc61be5982b7659
SHA256

48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885
SHA512

ea8a17a59b86d2085cc4bab6eedd8c4c12cf1a929c80859b8afb2754af861e1e08e221124541abcfae7f6f6bfc73663aa79784d8d04fcc1714702e67effa4d0c
SSDEEP

3072:6xes1L7Nap5sPGqOyaZySXBZe52uEy5egY6sQiiLZUvZ8StQyw:68sTmZqOyahXq52E7sUZUZ8ww

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27
PID 1284 wrote to memory of 820	1284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll,#1
  2⤵
  PID:820

memory/820-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/820-56-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/820-57-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download