1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d

Analysis

max time kernel
8s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:55

Target

Ծע/iext5.dll
Size

324KB
MD5

9d06808df2f2c7b12f13e29ad5758e1e
SHA1

ac4d3b358bfe6f03ec93a3b0aa84349ff1854ce5
SHA256

78fb1c83193f6cd29e7e630abb2612b8b2f5698509095e9cbac5c1ee43859bc8
SHA512

5ea4eb7cdc62d24ba6e37fe3a3d431f326f4502557d73672520d4ba2d85e73f27d925d3a9f5cf824e86101f378b2716b47b9f6c5cb457594d1e689387bdb7dec
SSDEEP

6144:oF3eyPv8sYviSKZFuULsJ0jgBy0nw80E1nPnzn+nunOFnnTngn+n+8f8888YJ27x:kP0DKZiy011nPnzn+nunOFnnTngn+n+o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28
PID 1276 wrote to memory of 1380	1276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\iext5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\iext5.dll,#1
  2⤵
  PID:1380

memory/1380-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download