b5d8e4ee2e823e9c9331ec2e0452bf1917785c4f30d34af3bedb7e4e438d65a6

Analysis

max time kernel
222s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:06

Target

b5d8e4ee2e823e9c9331ec2e0452bf1917785c4f30d34af3bedb7e4e438d65a6.dll
Size

448KB
MD5

b05baa6d2d91b79d50a67167d3e4e600
SHA1

acb335d6ae1b9721c9750ccf2ea1a7d2ab1becfa
SHA256

b5d8e4ee2e823e9c9331ec2e0452bf1917785c4f30d34af3bedb7e4e438d65a6
SHA512

fca9cb9cbef8ee0150cb27ee47d336014dc71c3ca1d2a2b0876084f804f670fd23a22373a6d717dabb145430c38d23c8ec2bc46a1c881d5da592aa521680cf67
SSDEEP

12288:jZkbB/ETMR6mjz5QnSVU/y2J3wVkkVLsUQaS5mgO:jZkbB8TMR6mjz5sJ3wVkIs1asO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28
PID 1348 wrote to memory of 852	1348	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5d8e4ee2e823e9c9331ec2e0452bf1917785c4f30d34af3bedb7e4e438d65a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5d8e4ee2e823e9c9331ec2e0452bf1917785c4f30d34af3bedb7e4e438d65a6.dll,#1
  2⤵
  PID:852

memory/852-55-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x0000000004130000-0x00000000041A1000-memory.dmp

Filesize
452KB

Download
memory/852-57-0x0000000004130000-0x00000000041A1000-memory.dmp

Filesize
452KB

Download
memory/852-58-0x0000000004130000-0x00000000041A1000-memory.dmp

Filesize
452KB

Download