a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:46

Target

a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll
Size

560KB
MD5

d40aac7022975980a04c34b418eb5120
SHA1

a842e9ca3fc954fe02a8e9b3005857c9c00f7f09
SHA256

a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278
SHA512

186a93d2ea2d7f5ab22b6316e513bf17be46393fb26202965431f8a1cc5a4edc89db292475a667705a136e57c1e972bb3bab6f07e05ced4718df3c82e664e165
SSDEEP

12288:IiY0EJ5OYJ/b+jM+j2TAb7z/gAJQjqpdBuA:XY0wpF+A+/gkQjqfBu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll,#1
  2⤵
  PID:668

memory/668-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download