8508356d143d666b8024301fa831ade1954a5b604d318fe9550b21a2cb0953ac

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 13:04

Target

8508356d143d666b8024301fa831ade1954a5b604d318fe9550b21a2cb0953ac.dll
Size

6KB
MD5

067b26c2abfb1e07bc9c3d5ad2703ba0
SHA1

f8696fe72df344aff7e66a1ee080e5e79d15197d
SHA256

8508356d143d666b8024301fa831ade1954a5b604d318fe9550b21a2cb0953ac
SHA512

f4c799595093986b7f732ab39bd38329b590dcacddea098cbbb09b90640b2d07c7f12b13ac929e562cae0a401d31de8372c4f28eff7e5bce54e28928e898946c
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8508356d143d666b8024301fa831ade1954a5b604d318fe9550b21a2cb0953ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8508356d143d666b8024301fa831ade1954a5b604d318fe9550b21a2cb0953ac.dll,#1
  2⤵
  PID:1612

memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download