a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:00

Target

a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll
Size

32KB
MD5

f43457e6a5f61eb2207fc248001e6e7a
SHA1

278811c498895c7e9548fbed19796bbc970bd1cc
SHA256

a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d
SHA512

8e1798153f58a1556d5f916d2d82e4c7d0777e25fff2ac60116411f5a2485030fd7c42fedecc8b0d4733779c8fef6716ed20835ec659845128f1636a6cfd11c4
SSDEEP

384:dWRxD56W1rRy2408lh/jkcIRagzN5wj7D77iYfiIuIzawYJFJLCRCkI8a:K1QWtHd8PZIaaN5kD75KINzhqDmRCkIT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20
PID 1368 wrote to memory of 972	1368	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll,#1
  2⤵
  PID:972

memory/972-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download