a298949bb4850edd6d5516d8f0cb5ba61d451cf36741d799b36861a353fc1f58

Analysis

max time kernel
37s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 04:22

Target

a298949bb4850edd6d5516d8f0cb5ba61d451cf36741d799b36861a353fc1f58.dll
Size

66KB
MD5

76d3503103967039f7e79c2ba7ffba08
SHA1

b3a3bdbdafa57e03e660110597c93afd4282f010
SHA256

a298949bb4850edd6d5516d8f0cb5ba61d451cf36741d799b36861a353fc1f58
SHA512

835362a482e5b551f82fe31a4b83fb0604ec2d986e1a6b7ad0f415e18e6ea719a883b18832f840c6193f7805ee69c300a8752f13d58e559873f051a8959c2293
SSDEEP

1536:mPO6KEVbsVP0ga5ZCyuSsrNV9MYOiwA4X/U28kkWt:cMEVbsVcbNhYP4X/FkWt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28
PID 1812 wrote to memory of 1728	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a298949bb4850edd6d5516d8f0cb5ba61d451cf36741d799b36861a353fc1f58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a298949bb4850edd6d5516d8f0cb5ba61d451cf36741d799b36861a353fc1f58.dll,#1
  2⤵
  PID:1728

memory/1728-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download