5547ca8d0eb75221d20517190ecb66deb003b625a62e79aec9a9ec6ab6aaccc3

Analysis

max time kernel
40s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 04:26

Target

5547ca8d0eb75221d20517190ecb66deb003b625a62e79aec9a9ec6ab6aaccc3.dll
Size

33KB
MD5

5ace26b5787f9c2ec594de0565906288
SHA1

414c9c9d7a517ebe8c299514f936e93a60b3b27e
SHA256

5547ca8d0eb75221d20517190ecb66deb003b625a62e79aec9a9ec6ab6aaccc3
SHA512

f099ce9082f26f6bf73c28f3008e57721a9555ca0b428925dfd4dddc5094103b216dfeea07e62c492aff3037375b613c4f08fd5735e3cadd47f13b76700c0a72
SSDEEP

768:IbthYton1M/4wgYn+07AQuzphqDLRr1j8:Ibtko2gYr7AjVkHRr1Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28
PID 1992 wrote to memory of 1972	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5547ca8d0eb75221d20517190ecb66deb003b625a62e79aec9a9ec6ab6aaccc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5547ca8d0eb75221d20517190ecb66deb003b625a62e79aec9a9ec6ab6aaccc3.dll,#1
  2⤵
  PID:1972

memory/1972-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download