c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:57

Target

c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll
Size

6KB
MD5

5e196d2b855cb281bedbe4f56859b610
SHA1

5b95797191a7660dc2c95cc53eaad47b365a9757
SHA256

c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a
SHA512

79ad48142c1b8f30fa00eb60142f4b5bb10ff59a7f6e2ba485c5159e558f58f132d561a4df32c5780e8b8a9896e9603dcd3122c8f3a6ecee7077ed6854cb0b21
SSDEEP

96:WLRxkjujtjd8jPjcZG2UoGd3vdtsfpEyBSk7nr/7IJ:WtqKR6bgYI8nKpEyBJv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28
PID 1172 wrote to memory of 888	1172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll,#1
  2⤵
  PID:888

memory/888-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download