5d6907cdb63d43e4daf786f1b2f3fff620c55f30d6228b73561d31e42c746936

Analysis

max time kernel
5s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 04:09

Target

5d6907cdb63d43e4daf786f1b2f3fff620c55f30d6228b73561d31e42c746936.dll
Size

33KB
MD5

5a21137fe259ab172e52a4cb73ef569a
SHA1

d5e465a3d9c6bc4ad84e8da26f8e17457dfd9b60
SHA256

5d6907cdb63d43e4daf786f1b2f3fff620c55f30d6228b73561d31e42c746936
SHA512

073c209c3ed08490338e59cd4f4380d4eb3cd4d34d9b6c25351c0a230e839c70ff1b1befa1d43e42fb236301268fa9aae0244cf6cb5dfa7a17934d06d00199f2
SSDEEP

768:39qeula2iuu4enYOE7IOIoSYhqD6RBu6J:39qeulu4eYj7IOI2kGRB7J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27
PID 304 wrote to memory of 888	304	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d6907cdb63d43e4daf786f1b2f3fff620c55f30d6228b73561d31e42c746936.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d6907cdb63d43e4daf786f1b2f3fff620c55f30d6228b73561d31e42c746936.dll,#1
  2⤵
  PID:888

memory/888-54-0x0000000000000000-mapping.dmp

Download
memory/888-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download