b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab

Analysis

max time kernel
34s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 01:25

Target

b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll
Size

123KB
MD5

0e2ee0ecceaecffb9178332ab174be90
SHA1

1ebe74301b7084bdaa514f5a8c51d14158c553d9
SHA256

b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab
SHA512

bc5ba40014c950d6099faa52bd8f57233081d72d68afb8eae470b230ef1ed7a96d38e5d69e48eae5237283d10c5bd8794a660f61643b701f45f6766cd5d160a9
SSDEEP

3072:YkTUoOajm1U+5zSWr9Xv3mB3j3oF6YtKwmkaxQS46fZxW4jB:gaYU+RZ+Vj3UdhAxQyfzB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll,#1
  2⤵
  PID:1236

memory/1236-54-0x0000000000000000-mapping.dmp

Download
memory/1236-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download