57cefe85ddb96c8d2bc9b1f87e46a46a9660560ac202b400a193cb2902bf6e1e

Analysis

max time kernel
143s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:22

Target

57cefe85ddb96c8d2bc9b1f87e46a46a9660560ac202b400a193cb2902bf6e1e.dll
Size

15KB
MD5

cad63e728a883ea3e94bf6f7ba78de38
SHA1

027bbbbf600b628a21996afe81076f92d1760f62
SHA256

57cefe85ddb96c8d2bc9b1f87e46a46a9660560ac202b400a193cb2902bf6e1e
SHA512

5b0fe7ea304c1a65812c934f5b1d15e7de8b9f8599f51b5e8d42bf892b0cb9022c6b5837d68ea2e4121f2474c76da25263a392f5599fa36ce1d3f7a69e3026df
SSDEEP

384:whVnhHdnhHFnhHt3hKwUXx9T2hmrPmOKR2AMqoJdBlMFmz48:GUhAhmDm5/oplNz4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57cefe85ddb96c8d2bc9b1f87e46a46a9660560ac202b400a193cb2902bf6e1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57cefe85ddb96c8d2bc9b1f87e46a46a9660560ac202b400a193cb2902bf6e1e.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2032-57-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download