dbd31648d5e4a84aa22e78d25a42313aee1864dc74556d2bbbdb584447f26218

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 02:31

Target

dbd31648d5e4a84aa22e78d25a42313aee1864dc74556d2bbbdb584447f26218.dll
Size

28KB
MD5

788020afeb2b097a8121083fb5a011b0
SHA1

e071c1361bf07f57726702fedd5d1fd5f1c30b4f
SHA256

dbd31648d5e4a84aa22e78d25a42313aee1864dc74556d2bbbdb584447f26218
SHA512

42849f423f3976d4472010ab4f79470ea53c735e3182c9d97db3fe210e454296a54a5e2ec49ae04d87a52886252b6ffe4819837b9dc0f2ed3abd3cab48d2d705
SSDEEP

96:wM1+l2n11FhplC7N7lM1y+BnOOB9ErQAQY:nwrQAQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17
PID 1320 wrote to memory of 2028	1320	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd31648d5e4a84aa22e78d25a42313aee1864dc74556d2bbbdb584447f26218.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd31648d5e4a84aa22e78d25a42313aee1864dc74556d2bbbdb584447f26218.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download