48ad1021738087fa25e493859210d01baaa595dd897044785adc48bdef4c918c

Analysis

max time kernel
72s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 20:02

Target

48ad1021738087fa25e493859210d01baaa595dd897044785adc48bdef4c918c.dll
Size

63KB
MD5

447902c05f47c58f2817241de24d9247
SHA1

da9b1824d263cc0e60084fec68972824629a668f
SHA256

48ad1021738087fa25e493859210d01baaa595dd897044785adc48bdef4c918c
SHA512

03b5d99e592a8e75e1ceafdeb4a1e3bf536aba90138ac790dd68ea3194c1a1a0bc9656b1e8ab89843265f1f5ca7ef5187d50ac337d16d7316c4d5bf51bbbcb37
SSDEEP

1536:VOzB/iU3fN5MruNlzJWn34GAyc7BoWPZZeKtBw0uqAS:VK/iS0uN5JW3ENoWPZZemBoq/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28
PID 300 wrote to memory of 1880	300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ad1021738087fa25e493859210d01baaa595dd897044785adc48bdef4c918c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ad1021738087fa25e493859210d01baaa595dd897044785adc48bdef4c918c.dll,#1
  2⤵
  PID:1880

memory/1880-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download