92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:10

Target

92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll
Size

4KB
MD5

7c1b25e904c6edfba585787a5fcaed80
SHA1

e3ea0677685d99e8fb4e7ea4d6288bbe32b16127
SHA256

92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536
SHA512

f8d20f4cf429aa5073d98e18f84cbcf24105cdbc4fec1e6ad5afe2e530283e177fde717b308ec6707c421608e6b70e4197e164087ede088577c03212ef7560d3
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LYLeScEljoLx2VFDtW8+uS4yMt:TRphMzf8YqSB2Ls/I8zS4H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27
PID 1340 wrote to memory of 1276	1340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll,#1
  2⤵
  PID:1276

memory/1276-54-0x0000000000000000-mapping.dmp

Download
memory/1276-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download