56ae0d959613f9562801f32bae8211bb46f031bc450e1a671b667a0055297fe6

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:08

Target

56ae0d959613f9562801f32bae8211bb46f031bc450e1a671b667a0055297fe6.dll
Size

420KB
MD5

52c36df1f676b2583ada67545fc38082
SHA1

38091b75242ce427fa60bcdfea1c5e15cd0c1f1e
SHA256

56ae0d959613f9562801f32bae8211bb46f031bc450e1a671b667a0055297fe6
SHA512

0f550b5438426877919510127919e46eb397cd0bfd3090232f5ac8291daedab013d17660f62428af6bffcbc3427be12fe3a5af0600e6de9c1cd7224b4cd8bda3
SSDEEP

6144:wIShXnldK0HXA5Py3DvTXA7aakxe3TC5wrjV+Y2uuP5RMZSBlYYe+vdsDVwuFnu:foldxw5K3Dv7Aea5TCat8xRMMAu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ae0d959613f9562801f32bae8211bb46f031bc450e1a671b667a0055297fe6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ae0d959613f9562801f32bae8211bb46f031bc450e1a671b667a0055297fe6.dll,#1
  2⤵
  PID:1224

memory/1224-54-0x0000000000000000-mapping.dmp

Download
memory/1224-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x00000000001F0000-0x000000000025F000-memory.dmp

Filesize
444KB

Download