cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:29

Target

cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll
Size

57KB
MD5

aa4e707a1795b45140f18d8c982401d8
SHA1

658d4b81f560769779744bfdef036cb355093b27
SHA256

cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0
SHA512

16593e11490693bfb62020052ebe1bc91fe224f45efb67d5fc146abaf048bc13cae828e16730fe3201ee37fa467f187f035315e4b769a6940dfb2f4428c59f4a
SSDEEP

1536:RNIKDP4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:cqP4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download