327ae93fec7f0af482bd19d257cde01b8a9743e62450930fcd330f2cb445ac2d

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 03:48

Target

327ae93fec7f0af482bd19d257cde01b8a9743e62450930fcd330f2cb445ac2d.dll
Size

56KB
MD5

214d6edae74466468a103071d63f1be0
SHA1

24ccb365385723e4d995f66d7092de6309c36647
SHA256

327ae93fec7f0af482bd19d257cde01b8a9743e62450930fcd330f2cb445ac2d
SHA512

2db2f2ee9f6559cc6b240743adaa1cf0c0c533d2dba63ec57f7c0e9184188b6b26b8ac5112deace69697cf4147408c437683cb3ee4d73ea529958bfca111602e
SSDEEP

1536:Bm1NGJVGGOQHeVyIKtUA0V4L2dR/wI4bp4CzTl:kX0VyQHeVz0UTGUm1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ae93fec7f0af482bd19d257cde01b8a9743e62450930fcd330f2cb445ac2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ae93fec7f0af482bd19d257cde01b8a9743e62450930fcd330f2cb445ac2d.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download