768541dc0b64ae6dda74ed293c212f9c91121457f0fd589f21f81528ea1d1848

Analysis

max time kernel
41s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:13

Target

768541dc0b64ae6dda74ed293c212f9c91121457f0fd589f21f81528ea1d1848.dll
Size

219KB
MD5

c5954762077fe08f150bb800c2ec1dc5
SHA1

5f78753c26039f1c80f9c4938fc4b8b0255b54a7
SHA256

768541dc0b64ae6dda74ed293c212f9c91121457f0fd589f21f81528ea1d1848
SHA512

f052a1888bf3521fc6d3c87a0bf43d8bb2b29321576b6e82698ad29bf9ae886d3caf20213adf0b13503cbcf74b962a75cc234479b7c098658bdde5ea0581662d
SSDEEP

3072:C/NpSAw3YKwgE6DaMraZtoTFFJiPWFD1GPld8odyLwFRlosEyFhIIAtO44b2mFvY:GNzTKwJ6DaM64YPGEX2wFhIIcBevFvY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28
PID 1664 wrote to memory of 948	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\768541dc0b64ae6dda74ed293c212f9c91121457f0fd589f21f81528ea1d1848.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\768541dc0b64ae6dda74ed293c212f9c91121457f0fd589f21f81528ea1d1848.dll,#1
  2⤵
  PID:948

memory/948-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download