e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975

Analysis

max time kernel
58s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 20:38

Target

e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll
Size

374KB
MD5

7a4175dee5b22cdddf901758df86ccc5
SHA1

c9d826fec7f8eb3b2b561e36d83b842163510a6c
SHA256

e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975
SHA512

b7f32a5b7293aa53eed618e9dae0047007bc8c960066009e5bf350341d37e23e00391e6a7632e3c8d0691598f584143527904b56cbeb571317084de08b629e2f
SSDEEP

6144:fiXXeyfDkBWC1z9r5k54Z5UALlpiDyVQi1hdwtW7zoxtAdjdjZAh4l:AOy7kz1z9r5kwJlID8XvoxtYhjZgO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28
PID 2036 wrote to memory of 1972	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll,#1
  2⤵
  PID:1972

memory/1972-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download