4a0840bc8396d081139ad59c7ac22ca9f3ab28a2a027d6a88b695c4aabbc2452

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:53

Target

4a0840bc8396d081139ad59c7ac22ca9f3ab28a2a027d6a88b695c4aabbc2452.dll
Size

67KB
MD5

0853e7aaec434849cf6e07e57c9344d0
SHA1

6ccfdc64949bcd17bd485184ca69eae429b510cf
SHA256

4a0840bc8396d081139ad59c7ac22ca9f3ab28a2a027d6a88b695c4aabbc2452
SHA512

3eb100eb372ef438ade07bedf81337e513537ea6d6766c61906ae9db99fcd153024fb3b398f19d089823d492c1e2222b814b5a128da9ad12cc6ea92e2c16ee4b
SSDEEP

1536:wvJpyfY820v+0WsJ3Bdxf5Jk+hF7S7kVlp62EN7n4ocRFfSr:6pv1o+c3B75Pk7kJ62E94ocLfSr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27
PID 1228 wrote to memory of 2040	1228	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0840bc8396d081139ad59c7ac22ca9f3ab28a2a027d6a88b695c4aabbc2452.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0840bc8396d081139ad59c7ac22ca9f3ab28a2a027d6a88b695c4aabbc2452.dll,#1
  2⤵
  PID:2040

memory/2040-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download