d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 05:16

Target

d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll
Size

32KB
MD5

08da52fef8c71cc865c6dca5f12d9c20
SHA1

263a771f257dc947a7dede27a82971c1872478b8
SHA256

d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0
SHA512

8d1fdb1b983feafc91c31851526bbef7a171e979f2b18ae9625570d94c4179b6ef3ed6dd783ac0cc386d206a2284687e1c038fa86fbc3094fd3643e04ba77499
SSDEEP

384:0YtYauty9x9aNoIS9Vic7JnnnfiWLwcde7QfOup77WH8+vOaMr+a0nJfBlvCR+9F:DtYlPuwcdfiwde73up7IBvOaA70J5ERa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27
PID 1272 wrote to memory of 1332	1272	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll,#1
  2⤵
  PID:1332

memory/1332-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download