8a5abb390d22b197fa463bdfd8aeb3f2af0cee0a8e8a3b6b848af26a5bfd5a58

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:18

Target

8a5abb390d22b197fa463bdfd8aeb3f2af0cee0a8e8a3b6b848af26a5bfd5a58.dll
Size

56KB
MD5

53811710d0750ac9f7d87356c6400df0
SHA1

4e00098cd85b24cfef7e74cf8a3ae83baac6784e
SHA256

8a5abb390d22b197fa463bdfd8aeb3f2af0cee0a8e8a3b6b848af26a5bfd5a58
SHA512

b94fdd8c9a152370a06bf3680ab19b0305e994f3a0719cf8247613b365eb68279f9a2e1b740b02c0d38f1bead254c0295bf83d2953dccae763ff40bf97ad6c0a
SSDEEP

768:gWtR8eNLjXcemrEfLhnR5s+qonLVa0zndF0oglk5x+oj9yiD+5oKwAbV:gWP8sL/mexRqgfdiFZoJAnwA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1800	1584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5abb390d22b197fa463bdfd8aeb3f2af0cee0a8e8a3b6b848af26a5bfd5a58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5abb390d22b197fa463bdfd8aeb3f2af0cee0a8e8a3b6b848af26a5bfd5a58.dll,#1
2⤵
PID:1800

memory/1800-54-0x0000000000000000-mapping.dmp

Download
memory/1800-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1800-56-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1800-57-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1800-58-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download