38e6b257eb4684ee8168796908b8a5c2e5bea492a45b53f3fab6a4985d90cac9

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 09:44

Target

38e6b257eb4684ee8168796908b8a5c2e5bea492a45b53f3fab6a4985d90cac9.dll
Size

67KB
MD5

1110e30b56ac51539f5157c68e5e03ab
SHA1

605c73a1a5d7a5c94a8134e91ccda2282272797d
SHA256

38e6b257eb4684ee8168796908b8a5c2e5bea492a45b53f3fab6a4985d90cac9
SHA512

5d56005a004274507332bbd704799dd7d93647cae832b627f28019f2cd303157f64759a790806e4e2c06eb093c20e9c9fae8959667940001c08c959f0507cb31
SSDEEP

1536:7nrxDussGn4AAejPC7Mp/c+HJgKKWz3p/wBBwA:D6tV0pk+pg6t/EKA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e6b257eb4684ee8168796908b8a5c2e5bea492a45b53f3fab6a4985d90cac9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e6b257eb4684ee8168796908b8a5c2e5bea492a45b53f3fab6a4985d90cac9.dll,#1
  2⤵
  PID:1628

memory/1628-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download