5b4ec8fb704f5cee98fe4deca658bf6f8b04410b7c566b1850e5e353ab3b20b5

Analysis

max time kernel
20s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 21:41

Target

5b4ec8fb704f5cee98fe4deca658bf6f8b04410b7c566b1850e5e353ab3b20b5.dll
Size

184KB
MD5

4f3fb0ba79c13d9ee0b0aa928bf7b950
SHA1

bdd2b12c993e73d7de1b889e84332c735b3c168f
SHA256

5b4ec8fb704f5cee98fe4deca658bf6f8b04410b7c566b1850e5e353ab3b20b5
SHA512

a38e1aca7c1cfc44b672dca843d22db3711bbe14ff6b14eb7b2f773b1b1fde2be8e0e0ccd4bc03a52b0db54f3dc3cedaf5d1e7a371b0e3cb7c58529025a1e7b7
SSDEEP

3072:7hYZ4z1sxtbjIUWnoRzgphYZ4z1sxtbjIUWnoRzG:SZ4zytbL0YZ4zytbLK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28
PID 1272 wrote to memory of 1512	1272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4ec8fb704f5cee98fe4deca658bf6f8b04410b7c566b1850e5e353ab3b20b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4ec8fb704f5cee98fe4deca658bf6f8b04410b7c566b1850e5e353ab3b20b5.dll,#1
  2⤵
  PID:1512

memory/1512-55-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download