b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:01

Target

b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Size

20KB
MD5

064ee2886b29169b78956133017c8736
SHA1

91c5c6e65356bd94c18e4ea540aa24d84f080d12
SHA256

b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b
SHA512

ad3665d21a58c008ad78a853811afd2843db8c7c1b05ca336d74639073e86737845c17a5ccd2ded951a749215cddf7bd5bd4a274d240a4c2c08d14250fa4878d
SSDEEP

384:E8e/FlJnjG7mmpPdEizc1Tus9mViVaVBVqVd+Ve+VqVE1:UF3njE1biTutUcvYWts

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#1
  2⤵
  PID:1076

memory/1076-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download