db658d83b83f1e4884e903c18f0d6027ca6cc160450fd8c1a9eee35cee9d2119

Analysis

max time kernel
63s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 11:06

Target

Usp10.dll
Size

88KB
MD5

0aa357c084039538022f812ff791681d
SHA1

a8cac315b130df723d3dc1b0ec1df608819a31c0
SHA256

68baefabf08f9fdb1a2b6bb15715cbee2928a2ae2b84ba141caecee752d4ca98
SHA512

8602dc09c0e725b8ec704b604d2d95f5400f6a63b0dc8d93c1b7788df252a8c18b7cb6688950c26a3687598b06ce95ce4712b6036ee27af65b015452274bf3d1
SSDEEP

1536:twHJ5SFonnBd0yChao8dG3bFypSYpoNi2JVr6FZTHxfLwwm+IykV94DVPR2oNY:ap5SOd0y0atdYjYpii2j6FZTRo+o8VPg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28
PID 1136 wrote to memory of 1500	1136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Usp10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Usp10.dll,#1
  2⤵
  PID:1500

memory/1500-55-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1500-56-0x0000000074F30000-0x0000000074F40000-memory.dmp

Filesize
64KB

Download