45aad8882b471dd59756d8a090809bfb63084be3646cf66d9134bb6939ced6df

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:40

Target

45aad8882b471dd59756d8a090809bfb63084be3646cf66d9134bb6939ced6df.dll
Size

1.0MB
MD5

926c107aaf480c6f0b0f03ff4c9723a6
SHA1

d64111ad46241022657486ee608d1cc61bc9e607
SHA256

45aad8882b471dd59756d8a090809bfb63084be3646cf66d9134bb6939ced6df
SHA512

46e8e0726a79b539b2da5fd02adb87a4955d4937b81ec7b28efcfcae5e89edcdd8dce30d0e97f74528a756de793f718f20ce6c66a1ef7f9b4157a1b1ce155133
SSDEEP

24576:foLNBQmXcVTzrjsI5t2OpLyPVFAJ4fn9AP/hIj:bmMNw+2Iyv+P/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45aad8882b471dd59756d8a090809bfb63084be3646cf66d9134bb6939ced6df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45aad8882b471dd59756d8a090809bfb63084be3646cf66d9134bb6939ced6df.dll,#1
  2⤵
  PID:1260

memory/1260-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1260-56-0x0000000000171000-0x000000000017D000-memory.dmp

Filesize
48KB

Download