4e44d7361e34f2015b0d762429dc8c11b89ac82b1114dadead56d27372efdc4b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 02:38

Target

4e44d7361e34f2015b0d762429dc8c11b89ac82b1114dadead56d27372efdc4b.dll
Size

18KB
MD5

08bd30c8fd8846e900dc9e0d96269be0
SHA1

aecb926600942726303a472bb2c631cc9d5a4674
SHA256

4e44d7361e34f2015b0d762429dc8c11b89ac82b1114dadead56d27372efdc4b
SHA512

e59ee0392e638d613dcf91133130c8386f2aff35f4d98dbef7acdb23183349dde72bd880b812eb73b511e9b95854f11e2020188230e56f5d8001beb6efb14e21
SSDEEP

384:GCiGC+GoC37M6F0yWqYkD68P5V+oErc60viKAV1AlO:RiO27MUWXkv5V+oErcXvnq1AI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e44d7361e34f2015b0d762429dc8c11b89ac82b1114dadead56d27372efdc4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e44d7361e34f2015b0d762429dc8c11b89ac82b1114dadead56d27372efdc4b.dll,#1
  2⤵
  PID:536

memory/536-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download