7049389de041f850eda21994b1ff391179c5542543e8e6abb97cac75e63b2e19

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 21:21

Target

7049389de041f850eda21994b1ff391179c5542543e8e6abb97cac75e63b2e19.dll
Size

4KB
MD5

0cd6ad36833b6447ac1b9a5d9596134c
SHA1

76a38d72c6ce3e86be0cb13e475f9da22bfa0bdb
SHA256

7049389de041f850eda21994b1ff391179c5542543e8e6abb97cac75e63b2e19
SHA512

a016c4cd1031223c55a91141e123c31db0ff34798902f7b7953dad8b56d769dfb9ab1406f8a1c570f7de343e7e8ec70ec2f082376f5d101686e63f1a28740955
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKCLQutqYdZBbMQWOkJk8WSRyn1hD:PT3r2vu9bRQhWlnP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7049389de041f850eda21994b1ff391179c5542543e8e6abb97cac75e63b2e19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7049389de041f850eda21994b1ff391179c5542543e8e6abb97cac75e63b2e19.dll,#1
  2⤵
  PID:1108

memory/1108-54-0x0000000000000000-mapping.dmp

Download
memory/1108-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download