33a6e5fb02f659037ba049c8e07f6c4cb28bb5f19834293f420761373d61c326

Analysis

max time kernel
34s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 14:34

Target

33a6e5fb02f659037ba049c8e07f6c4cb28bb5f19834293f420761373d61c326.dll
Size

77KB
MD5

067e399a3417ee5f0cd1e4f1afc05e10
SHA1

f7708b0c71bf40143894eeb5e2b9cca3486ea913
SHA256

33a6e5fb02f659037ba049c8e07f6c4cb28bb5f19834293f420761373d61c326
SHA512

824adabb5c434e50d1e512404bb50687a15e391c5a0d0d335db3fe78e5f71a9c4350f4d21875a5c3e3deec339aa6626862f8b727e52ebd21a88a343d7e73829f
SSDEEP

1536:cHWmsuL8yN4xoi0AcR73fc8vsWjcdu8i8qY:2WUAJaQu8i7Y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33a6e5fb02f659037ba049c8e07f6c4cb28bb5f19834293f420761373d61c326.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33a6e5fb02f659037ba049c8e07f6c4cb28bb5f19834293f420761373d61c326.dll,#1
  2⤵
  PID:1536

memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download