4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:39

Target

4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll
Size

56KB
MD5

b223f7e9f3112683150ff0af092fbf80
SHA1

bb5515499fb3f297786c5ad98b2d167b75da051a
SHA256

4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15
SHA512

cf1160b3a1fc4deba18c839bfcfff749e88bd45c70578860577a77cf235800b0a6dec7c3ab6c1edebc4623326f4f806353eb59aa1363613cffeeecf72f1adfe0
SSDEEP

768:OCs2g4T7She14Rme58//lDoyYX0uteYDIdA1o9B4o:vbg4fSheOmTlDPYXBM8oP4o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll,#1
  2⤵
  PID:1808

memory/1808-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download