b5021650e7098ce1d5bf1a4ad0852d5a32e5de6e741800af9fb5e14a58dfab87

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:26

Target

b5021650e7098ce1d5bf1a4ad0852d5a32e5de6e741800af9fb5e14a58dfab87.dll
Size

99KB
MD5

18aa3e70cdb12afbde5dd87372c689b0
SHA1

0462af38b0645df52c4ae094ba85d30f79792166
SHA256

b5021650e7098ce1d5bf1a4ad0852d5a32e5de6e741800af9fb5e14a58dfab87
SHA512

f535d44d63b5af5e43351a8e0655ce64322ff068bbe7c9f3a114f7a907a72a07945ea60c7cc72d9ada9cef7c1e58a3e0206388131c14d63ef4a33c906c1f0282
SSDEEP

1536:QoqY2Q4vGRKSh3d2Sy7xl0axozMXqtGNttyZunJE9:j2NvGcSX47xl0axo46tGNttyZj9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5021650e7098ce1d5bf1a4ad0852d5a32e5de6e741800af9fb5e14a58dfab87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5021650e7098ce1d5bf1a4ad0852d5a32e5de6e741800af9fb5e14a58dfab87.dll,#1
2⤵
PID:1324

memory/1324-54-0x0000000000000000-mapping.dmp

Download
memory/1324-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000000100000-0x000000000010B000-memory.dmp

Filesize
44KB

Download