2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:48

Target

2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll
Size

6KB
MD5

b396594b36cd98e478fb0bdff7d07550
SHA1

2ec12e573821761f6a5e8393bd2c451fb1ba5533
SHA256

2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378
SHA512

b6a8dda9fba0bb03372c97489327de6a2571b0f42dc756774c023fd12dcc8200395356b64f85826eb816900402afc76e7343250ffc97fe531eac3dc36763c28e
SSDEEP

48:6tAj5YVOhzVsJCwGhpi//ZAwVmN21SZBbgDq9JkWaZOQBb:jhzVsJzG/c/2RN7MqXraZOQN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26
PID 1492 wrote to memory of 1856	1492	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll,#1
  2⤵
  PID:1856

memory/1856-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download