e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:49

Target

e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll
Size

6KB
MD5

70b06bb4ed2b53e48658e135c6f9c410
SHA1

1f5f4773f580084aec4c097358fb36a368d2c44e
SHA256

e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b
SHA512

a3afa9f39a05159c3f293f535d985c74caf791c5397bc65b2ba1300788d2dd408ea2eba97636d69d834719991d42a25ca7f384448fbe8dd05b30f11b948fe55c
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROU+0jBVB4:YXF+y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll,#1
  2⤵
  PID:1036

memory/1036-54-0x0000000000000000-mapping.dmp

Download
memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download