6d5b345798e57ab70021d58adeba8702e9f31c5ea152a6a7099a2d603bebb95a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 03:53

Target

6d5b345798e57ab70021d58adeba8702e9f31c5ea152a6a7099a2d603bebb95a.dll
Size

560KB
MD5

0a5113eb522356640a2a99c22b6f6c72
SHA1

c956dcf0e01b0163738178c86ece82f135101759
SHA256

6d5b345798e57ab70021d58adeba8702e9f31c5ea152a6a7099a2d603bebb95a
SHA512

d883b39f20e11d232e4af0725b81f297db23efb891128f2fd5983bab9068c9a120caa2c45638c9574858f076e3345a7e8548f66f5a0daf2f9abf45b3405b0a60
SSDEEP

12288:IiY0EJ5OYJ/b+jM+j2TAb7z/gAJQjqpdBvA:XY0wpF+A+/gkQjqfBv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1076	864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b345798e57ab70021d58adeba8702e9f31c5ea152a6a7099a2d603bebb95a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b345798e57ab70021d58adeba8702e9f31c5ea152a6a7099a2d603bebb95a.dll,#1
2⤵
PID:1076

memory/1076-54-0x0000000000000000-mapping.dmp

Download
memory/1076-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download