5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482

Analysis

max time kernel
30s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:37

Target

5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll
Size

6KB
MD5

6eda56c9d91ff45e7fd762a319ef3722
SHA1

079eaec9e5fd68e6b0333e45345b2b2988e887fe
SHA256

5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482
SHA512

b0c68456ecef927f557bf830a5a7400777191e37c702496393c2b4bfc645bd81fb5b9e68c8a95fa60ab16abafeb6fc98ff79a658e166f376cbad9b39ad385190
SSDEEP

96:MA/wSmnN36uqXlSuyKyZsl46AWUZXfMWGyG5St14g8JHz2WRyfL4PA/wSmhZklI/:GCpVluKZU+uGHg8JT2W0fL4xbHQA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1992	2012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll,#1
2⤵
PID:1992

memory/1992-54-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download