792b3ff6184c57d1141b45b47eaa169abf11d40165b28125b1aab6d0d935b26d

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:03

Target

792b3ff6184c57d1141b45b47eaa169abf11d40165b28125b1aab6d0d935b26d.dll
Size

32KB
MD5

b0cab8fb766735dcdf054b423a0c99d8
SHA1

43703c0bbfb58ad7f78853cb143354b2c40f8cab
SHA256

792b3ff6184c57d1141b45b47eaa169abf11d40165b28125b1aab6d0d935b26d
SHA512

dd745cc77c97ebe34f3d821bde2aa5521575bf1b19340e1a1002ec91b695a8c27dd0515995a5ba31029dc1d2ffaa732fd5cb2fbd711cf0b0ab4899ed3015fe82
SSDEEP

768:iUTHaQ5CPZ5mvC87Gt6ZWpNqOjsSRzVs+:iUTHb5i5mH7GtEDQRxJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28
PID 2028 wrote to memory of 1992	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\792b3ff6184c57d1141b45b47eaa169abf11d40165b28125b1aab6d0d935b26d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\792b3ff6184c57d1141b45b47eaa169abf11d40165b28125b1aab6d0d935b26d.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download