4a093e573a5cbfaeb73f299737838ef3bad81b1fcaa5db8f19cd91f69e89745a

Analysis

max time kernel
258s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:27

Target

4a093e573a5cbfaeb73f299737838ef3bad81b1fcaa5db8f19cd91f69e89745a.dll
Size

6KB
MD5

aab4a414572b9f8abf167cae3d309780
SHA1

63a220e6673fad49be6aec4253685852966055f0
SHA256

4a093e573a5cbfaeb73f299737838ef3bad81b1fcaa5db8f19cd91f69e89745a
SHA512

715157cec4feaece801f30453df06f35e0cce888c67bf6f74ea998aca1b3fb9c6c90f4ff4c7880476ee6d0da576d20cc3a8f147e0b5844de6982958d0b47507a
SSDEEP

96:nEY2RrF1eqwi4PeVGCH/UYDs6Y4QlarYCdD73nDg4H+uWb:EHRh1eppRCfUYDXhQlaEYDbDRw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a093e573a5cbfaeb73f299737838ef3bad81b1fcaa5db8f19cd91f69e89745a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a093e573a5cbfaeb73f299737838ef3bad81b1fcaa5db8f19cd91f69e89745a.dll,#1
  2⤵
  PID:556

memory/556-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download