995e42b21a18cd50d75fb4f26b79ddb814a04ffe5cb62ce48c3a4c02c101cc19

Analysis

max time kernel
32s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:44

Target

995e42b21a18cd50d75fb4f26b79ddb814a04ffe5cb62ce48c3a4c02c101cc19.dll
Size

57KB
MD5

cb1e20a1f874983b9479559fc4a59627
SHA1

e54737fa26fef0eebadf5a3a8de237ecf3510799
SHA256

995e42b21a18cd50d75fb4f26b79ddb814a04ffe5cb62ce48c3a4c02c101cc19
SHA512

cddf2378036e3d16ef74f5626b6c5e9e0925407a76d74fad9b04bf322d3f73fe0d93171d494c93527858c138c97d5735fc952a7e464e61d1091f587d6093bf4a
SSDEEP

1536:1NIKDp4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:gqp4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26
PID 1452 wrote to memory of 532	1452	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\995e42b21a18cd50d75fb4f26b79ddb814a04ffe5cb62ce48c3a4c02c101cc19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\995e42b21a18cd50d75fb4f26b79ddb814a04ffe5cb62ce48c3a4c02c101cc19.dll,#1
  2⤵
  PID:532

memory/532-55-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download