5ff0f0f275f8705cc51c8c804093aa95d1d0313220f835fe3963dbdc5513c30a

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:28

Target

5ff0f0f275f8705cc51c8c804093aa95d1d0313220f835fe3963dbdc5513c30a.dll
Size

22KB
MD5

a2396faf377c614f8640cbd11c872c22
SHA1

26649c4a62763cc28fc62da483eb5c47c815f911
SHA256

5ff0f0f275f8705cc51c8c804093aa95d1d0313220f835fe3963dbdc5513c30a
SHA512

003b0f3551dcf3eab48decdfdd815aed5dcce0e092b604d56714bdd8e9a8390cbf0eca2d59638f57a70335dd05af56f8fc49d2ef97b1592fa32a520a77ab5c74
SSDEEP

384:TeH+tWzlSDrb5+gIS3a2Oaa2pbNGJ38pPJv1TCAxAr6+S9Pfu7n5n:dtWurb6SOaVwYxv1TlxndeVn

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1132 wrote to memory of 1664	1132	rundll32.exe	28
PID 1664 wrote to memory of 1932	1664	rundll32.exe	29
PID 1664 wrote to memory of 1932	1664	rundll32.exe	29
PID 1664 wrote to memory of 1932	1664	rundll32.exe	29
PID 1664 wrote to memory of 1932	1664	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ff0f0f275f8705cc51c8c804093aa95d1d0313220f835fe3963dbdc5513c30a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ff0f0f275f8705cc51c8c804093aa95d1d0313220f835fe3963dbdc5513c30a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\Wscript.exe
    Wscript.exe c:\windows\ime\vbs\pp.vbs
    3⤵
    PID:1932

memory/1664-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1664-57-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download