30db135cd72b965179f53d7cb99462f64c56ae4458c55c3d668ac6a6df7465db

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:05

Target

30db135cd72b965179f53d7cb99462f64c56ae4458c55c3d668ac6a6df7465db.dll
Size

7KB
MD5

4f14c67f7a0e596301fdecfe36dcda60
SHA1

c8e024840a504549eec5594e5d41f284f8ab17a8
SHA256

30db135cd72b965179f53d7cb99462f64c56ae4458c55c3d668ac6a6df7465db
SHA512

b894c9a1cd269e18a1361471dc14c8a671c6d1a05289b0daf10ecb893e00e28f7c29f7bf4264d61906ed586c07b8a3240fed7ae6b2abed12c81a7a9bab3e4937
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvw:DixZjmjtjd8jPjcZGR5TI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30db135cd72b965179f53d7cb99462f64c56ae4458c55c3d668ac6a6df7465db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30db135cd72b965179f53d7cb99462f64c56ae4458c55c3d668ac6a6df7465db.dll,#1
  2⤵
  PID:1528

memory/1528-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download