5efeb58ed9c878790ef416c1173d67ef9bd3370e4040de36358ce5507ebcfe1e

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:36

Target

5efeb58ed9c878790ef416c1173d67ef9bd3370e4040de36358ce5507ebcfe1e.dll
Size

4KB
MD5

979ff98ec338d8b16850440cb8cad7e0
SHA1

450a57ea2830a3d63731124c190127ae6475b099
SHA256

5efeb58ed9c878790ef416c1173d67ef9bd3370e4040de36358ce5507ebcfe1e
SHA512

816b7b35266ca205907fa368ea030753e14d17431cb2dd0631faf4b5df47f51fd55d9842476d195fddf6e950fabe9464ad8147d03e1e29e336213d74d38a3cb9
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm98QqyK:PmkiIz8UZrQ0MhI/ITqly98QqyK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5efeb58ed9c878790ef416c1173d67ef9bd3370e4040de36358ce5507ebcfe1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5efeb58ed9c878790ef416c1173d67ef9bd3370e4040de36358ce5507ebcfe1e.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download