388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 15:59

Target

388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll
Size

4KB
MD5

0d192f9e4d00d4c43271bf715fd075f6
SHA1

486ebaea9663b1251cc2687780d4fd122a6baa55
SHA256

388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4
SHA512

bbb83851e44b4d1e361a032d7895977841c197aa41b41a3a4fcf83bd52591c52a69fd7b2fb2f4eb2c5b2c090dbdfbfbbd4e210ab1d2a315101be5250835a2ee6
SSDEEP

48:a5zjMTGcITBVQVE1lcNpaUSKjp2MAIaTv/0nc1jfjXJ99:iT3Qu8vEKgignn1rx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28
PID 1032 wrote to memory of 1064	1032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll,#1
  2⤵
  PID:1064

memory/1064-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download