856de4b3565918dc912dd566063932813d661db9dd20e9a635878f098614036f

Analysis

max time kernel
31s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 18:10

Target

856de4b3565918dc912dd566063932813d661db9dd20e9a635878f098614036f.dll
Size

32KB
MD5

81ab6cfb91ffd0742b4e733977aca0c0
SHA1

ec9b05091c3142c07f51372a82d7a279f29d8411
SHA256

856de4b3565918dc912dd566063932813d661db9dd20e9a635878f098614036f
SHA512

be99bfcbb7f768bf8ba23b02ed44b64f105fc4c389fab1bc4520bcb0773859d6171135c9af03ef326e2be3282a868ebc2f872f32e6b2419cc70dfb2d69ab9ee1
SSDEEP

768:M24K7MjWs6CKSbjsFk+7grzrDN1hVf6ZyZsQ6:M24cY5KSs7gHrDrHUyZsx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28
PID 2004 wrote to memory of 1892	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\856de4b3565918dc912dd566063932813d661db9dd20e9a635878f098614036f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\856de4b3565918dc912dd566063932813d661db9dd20e9a635878f098614036f.dll,#1
  2⤵
  PID:1892

memory/1892-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download