59b11568d537bdf89c5a75e463cb79f300c056484cf146e47a77803f82214f83

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 15:18

Target

59b11568d537bdf89c5a75e463cb79f300c056484cf146e47a77803f82214f83.dll
Size

75KB
MD5

fddd7565165672478b073920ca62ef40
SHA1

22d9a3f6f01c3baaf4277c97091b98572288eaa3
SHA256

59b11568d537bdf89c5a75e463cb79f300c056484cf146e47a77803f82214f83
SHA512

56c8dad9b59559744b7a2a4bb028fa8182e10baa7864cc0f7444b2ce9c262310ef237d6a7471e71c626969ad55374d1be5967feac3d736018135f5b972a59225
SSDEEP

1536:+Kj2S7noPkX1EO4YdTmakON4iA3Hvxd0x18ll+desxdCNXOaK8:+K5hEO/Zb4Hvxd0x1Gsxdph8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28
PID 1724 wrote to memory of 1340	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b11568d537bdf89c5a75e463cb79f300c056484cf146e47a77803f82214f83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b11568d537bdf89c5a75e463cb79f300c056484cf146e47a77803f82214f83.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/1340-57-0x00000000754C0000-0x00000000754E6000-memory.dmp

Filesize
152KB

Download