fb5e491e382414868179efd9aa51c498467d702d7f427bd607de0fcb9e25f47e

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 06:43

Target

fb5e491e382414868179efd9aa51c498467d702d7f427bd607de0fcb9e25f47e.dll
Size

98KB
MD5

415532035c0ae0d0cd7e47082bb750c7
SHA1

761197e9eab661647e3b2e03b9106729dd604c6e
SHA256

fb5e491e382414868179efd9aa51c498467d702d7f427bd607de0fcb9e25f47e
SHA512

afa318b1496b33aa3b2e8c66227b93cfc0abb77b1528c1d3ddf05d19055bd77a85a64e9490eb1bd5eaa1ca54a2aae1157388d70fc0ba4ac0ede703951a77954d
SSDEEP

1536:8L2qVSc+E6aVunMCNZ7wA6o68Zitzzz4dBbr5sXfYt:W2Jnh0kMeZ36/8Cc5r5sP6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 1124	1700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5e491e382414868179efd9aa51c498467d702d7f427bd607de0fcb9e25f47e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5e491e382414868179efd9aa51c498467d702d7f427bd607de0fcb9e25f47e.dll,#1
2⤵
PID:1124

memory/1124-54-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download