c65940de404f5f5def920836b5412adb3ecf10880a5cb2cfa18db3161e1de585

Analysis

max time kernel
20s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:38

Target

c65940de404f5f5def920836b5412adb3ecf10880a5cb2cfa18db3161e1de585.dll
Size

6KB
MD5

38884fc33cb492d2f45aa418fa303e90
SHA1

423ad5c5f24fede9c41f3e41b652f0099f6fea81
SHA256

c65940de404f5f5def920836b5412adb3ecf10880a5cb2cfa18db3161e1de585
SHA512

ad00378e781ec31cca04056482d53764dc96aaf8a76fb7b363a4e41cb06337d94599eefd53045f471299ff138aab20e1be983b7996d285c0ef7024054d13c589
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRO39fiI4IWAC9GwgwoPFe8lwARQ:YXdI4FAC9GwgPg8lwAR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28
PID 1244 wrote to memory of 1740	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c65940de404f5f5def920836b5412adb3ecf10880a5cb2cfa18db3161e1de585.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c65940de404f5f5def920836b5412adb3ecf10880a5cb2cfa18db3161e1de585.dll,#1
  2⤵
  PID:1740

memory/1740-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download