a055d6f6abd28dc490273a9ed5ac87bf414115513432124bf5fc8af55a82b9b4

Analysis

max time kernel
19s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 11:23

Target

a055d6f6abd28dc490273a9ed5ac87bf414115513432124bf5fc8af55a82b9b4.dll
Size

182KB
MD5

2f29948a28de71666558a566ccf5023f
SHA1

68f0e46f8a8aaa2085c8a503c1349f827a09ba3d
SHA256

a055d6f6abd28dc490273a9ed5ac87bf414115513432124bf5fc8af55a82b9b4
SHA512

2b7178aab520884c1f57681714808194e4eedb9b40fd6f9e1482c5c4cbdcc7e8cd2b85358115f0f85fd47b1a17cbfa35437f02cbbbb4a6021da571068a682c66
SSDEEP

3072:g7rlajpxUb5zB3kCasgm6qSfpBKgl636s+ZkuVUQpAG/k:g/lKpxa5zB3/as6qSfpQa636G5QmG/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27
PID 932 wrote to memory of 1124	932	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a055d6f6abd28dc490273a9ed5ac87bf414115513432124bf5fc8af55a82b9b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a055d6f6abd28dc490273a9ed5ac87bf414115513432124bf5fc8af55a82b9b4.dll,#1
  2⤵
  PID:1124

memory/1124-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download