49db6ef7869e405358ef8a0fdd58b1dabf07e5947c5197964b3ccf4b981d1a41

Analysis

max time kernel
244s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:01

Target

49db6ef7869e405358ef8a0fdd58b1dabf07e5947c5197964b3ccf4b981d1a41.dll
Size

6KB
MD5

38145b2f5b9b1c0f5de20fc752af2c30
SHA1

7eb3465f08302029cf5d881a827c69d9d4f263ca
SHA256

49db6ef7869e405358ef8a0fdd58b1dabf07e5947c5197964b3ccf4b981d1a41
SHA512

812cd6a43b8edb34a3d272ded73d119ff42349820dae0d4b7f06ed17417ce345725c56edc2a072003ed10ba328e609fdafd1c35e6a37e96040f9b3ee60964f3b
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqFvdGJyG/a0T+o3TJqF2InxDSGyovVqYeoI:hy859x0P8MaFkvIFHxTgKU56I02AA/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28
PID 580 wrote to memory of 1032	580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49db6ef7869e405358ef8a0fdd58b1dabf07e5947c5197964b3ccf4b981d1a41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49db6ef7869e405358ef8a0fdd58b1dabf07e5947c5197964b3ccf4b981d1a41.dll,#1
  2⤵
  PID:1032

memory/1032-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download