5489dbecad61cc5054ddbcde6f782ec26ed8a28ce38d69cb8a81b8be7d8057b0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Target

5489dbecad61cc5054ddbcde6f782ec26ed8a28ce38d69cb8a81b8be7d8057b0.dll
Size

24KB
MD5

531f1c7b3058cf6e8c6d5b0b6881afc2
SHA1

695f9fe3fda3791de7c98e76510153c4c29de035
SHA256

5489dbecad61cc5054ddbcde6f782ec26ed8a28ce38d69cb8a81b8be7d8057b0
SHA512

9198e274e5b81daffcd713d3031e7a0bce596215716ff70ca3d2f06e8b8dc57903cad2f4a2645f6c904e4583f5ef7c43451849a7538f683315bd1949045d46b1
SSDEEP

192:1lmS9xWaWvd+YlSSDQ2sqImrcjjiWS1MhNP1TRG:1lmcWNd+YlSSDBsqITjeWS1MhNPG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489dbecad61cc5054ddbcde6f782ec26ed8a28ce38d69cb8a81b8be7d8057b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489dbecad61cc5054ddbcde6f782ec26ed8a28ce38d69cb8a81b8be7d8057b0.dll,#1
  2⤵
  PID:2016

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download