a6a5e2013a470559de3f7c755acedcc1088c3824cae778d6c8c76c16b22fe231

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Target

a6a5e2013a470559de3f7c755acedcc1088c3824cae778d6c8c76c16b22fe231.dll
Size

41KB
MD5

cc6d2f0d3e2982be8d1f37bb276e41a6
SHA1

a0d7993f265d19c0cd91070d68d84a24ee41a493
SHA256

a6a5e2013a470559de3f7c755acedcc1088c3824cae778d6c8c76c16b22fe231
SHA512

cea88dcdf6b6da2c894e234628d49784977de66bfbebe6b490195d622dceeac245d88b3ff429b3b6b0297e4db9bdde10e14a3b4278e8b2e1850f811bef9da67f
SSDEEP

768:SCpqFQtwmjmx+0jp61c4O99Yr3zhv8TUJmHps04BtzXBGkG+I8x:1pqFQVCNVdrYr3eUk8Vxa+Jx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2028	1872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a5e2013a470559de3f7c755acedcc1088c3824cae778d6c8c76c16b22fe231.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a5e2013a470559de3f7c755acedcc1088c3824cae778d6c8c76c16b22fe231.dll,#1
2⤵
PID:2028

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download