a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:52

Target

a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll
Size

137KB
MD5

00d0a934e71ef5457330ee514c4b7550
SHA1

4cb31c85d0a87e043d79974f83983aa979000f0c
SHA256

a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e
SHA512

4d751419e3915f6f432fa8416ed7cdd075f86995fc3f91c406d22c9d05f0123fbd68f9999075779e6e5526bc0a88145abc78f05a8f5dc0ae7f699a0d4babde99
SSDEEP

3072:S8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxv0ILi:S8w6D4Kotup0LWI+fQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27
PID 1088 wrote to memory of 1508	1088	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll,#1
  2⤵
  PID:1508

memory/1508-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download