55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9

Analysis

max time kernel
33s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 13:03

Target

55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll
Size

396KB
MD5

0cc61259b02624dadba4ce493399a76e
SHA1

35449c65b38b4303ec0502b1ba9cdd175b87f277
SHA256

55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9
SHA512

c73b850e679a4d387c59484c6e300075b897bff3939ea98bcc74da826b76f33e718e4c1df593af2714addc9a3e7cfa7f19cab201cfb7f6dc8b8800c5dd5d7ccb
SSDEEP

6144:KiMkQQbHJnjRx77SdWKNrZUqqDL6rGHrIrEewUdoIfK8l1hiVlgAEkO9:KJkQQb1SdWKN1xqn6rIv6K8FmlrO9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28
PID 1456 wrote to memory of 784	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll,#1
  2⤵
  PID:784

memory/784-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/784-56-0x0000000060450000-0x00000000604B3000-memory.dmp

Filesize
396KB

Download
memory/784-57-0x0000000060450000-0x00000000604B3000-memory.dmp

Filesize
396KB

Download