d63558d58424f1c02d7eb35407af48a9b5aaa9d6efc7d03c4c5c3b7680f3d011

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:53

Target

d63558d58424f1c02d7eb35407af48a9b5aaa9d6efc7d03c4c5c3b7680f3d011.dll
Size

4KB
MD5

d34cfcd74f7067f2cff3cbf70563a790
SHA1

fc4f5353dc7c0d8a860a1bade41c418728376306
SHA256

d63558d58424f1c02d7eb35407af48a9b5aaa9d6efc7d03c4c5c3b7680f3d011
SHA512

8e40dd92a2139359d62ea1735b4ae48605f858d2568bc55a9044280a3f9da0fc6ff2350db4e86eaec922208ef9940f17cb609c2054250efe75e526e58e7f30ac
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKaR1T++Af/WTwt4BayqfwNNCcaGc:PT3r2vu9ZN4feTi6ayogrc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d63558d58424f1c02d7eb35407af48a9b5aaa9d6efc7d03c4c5c3b7680f3d011.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d63558d58424f1c02d7eb35407af48a9b5aaa9d6efc7d03c4c5c3b7680f3d011.dll,#1
  2⤵
  PID:964

memory/964-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download