5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:01

Target

5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b.dll
Size

88KB
MD5

84f73873ae5fa41a274bbe3333e705b3
SHA1

19767762255d8c9a1ecc42c662dd33b0ffc11f66
SHA256

5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b
SHA512

4aa270284935e15a69ebf7ada9e6653f2fcf0ade93383ced6de2c8cfe0140a20b242311a5f591fe2766a811b2cff6c568a34010ad599bede9c0ed034ee7d1a1a
SSDEEP

1536:3ohsQOBxOWxKT2HZaum0JPx5tAYz0Jfob2v9oIGRf:3ohip0TIsuXtGJfob

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28
PID 1980 wrote to memory of 1972	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b.dll,#1
  2⤵
  PID:1972

memory/1972-54-0x0000000000000000-mapping.dmp

Download
memory/1972-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download