466bd19bec3ad558e4c01cea1d1cbba9867ddbbf731384509545eb032a8caa24

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 23:49

Target

466bd19bec3ad558e4c01cea1d1cbba9867ddbbf731384509545eb032a8caa24.dll
Size

14KB
MD5

91129f1c7a2526d433b7530c5d150609
SHA1

e40cbb479861d7606b2294fb54242144b38eec46
SHA256

466bd19bec3ad558e4c01cea1d1cbba9867ddbbf731384509545eb032a8caa24
SHA512

22d1cb15e5b5c0b688df65150274ac46973038d6a1f01cbe30aac7a344dd5d5900cc40150275de701fac550db52d0e7f64f5ef9cb34cbe179c93bdbe8807ed8c
SSDEEP

192:gyJ2xt/ZyhZEvGx857jC3NE3i+UGLM2k2AG5DnzkPXI1YSm:g5xvyhZEnm3NE3OGLLk2d5rgPoY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27
PID 1168 wrote to memory of 1996	1168	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\466bd19bec3ad558e4c01cea1d1cbba9867ddbbf731384509545eb032a8caa24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\466bd19bec3ad558e4c01cea1d1cbba9867ddbbf731384509545eb032a8caa24.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download