c5a2c2c73e1f59f222036d2067a5fa9eeb41e635256edf89f59132cb57beae51

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:57

Target

c5a2c2c73e1f59f222036d2067a5fa9eeb41e635256edf89f59132cb57beae51.dll
Size

7KB
MD5

078d187735289e15de349adb299e7640
SHA1

ef77fd7acfbb52e673a28a285835d4966ccce498
SHA256

c5a2c2c73e1f59f222036d2067a5fa9eeb41e635256edf89f59132cb57beae51
SHA512

c6b01b097b5c7565df8588a689cf4d7acb5f0e141cfed713e35fb4f91ec8b9a984865842c66ac9db181cfb307029a29085e56520629f1f5a4419d7f38036df10
SSDEEP

96:z0/gPtJrYmVjGwd+8blPDDDDDDDDEZSJutrYCS7YY1hg:FTiS+siZQErPS7YQh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a2c2c73e1f59f222036d2067a5fa9eeb41e635256edf89f59132cb57beae51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a2c2c73e1f59f222036d2067a5fa9eeb41e635256edf89f59132cb57beae51.dll,#1
  2⤵
  PID:1536

memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download