52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 03:52

Target

52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll
Size

57KB
MD5

178b6c49266b293626f28194d8e59f40
SHA1

d6600295c84e0dc9c5c66622f53cc0969c4cfcbc
SHA256

52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3
SHA512

9b7c6799768547b54a965b3c65cfc67b322553bdc4cf98e8bdb8364a8e047cb3e176a59f4cf7cbfa155e22220a7a7d4175bdf30a6dbfef170a2dd6cb737b5732
SSDEEP

1536:YJEu0nVKxUzxVp8WvcFEcoq/P1STl/fm85Ojw:YmJnVKxUzRkFEcoq/P1STl/O8Ijw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll,#1
  2⤵
  PID:884

memory/884-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download