59c85e5380c1c823d6f7aded38b8ea2426234428e17b9e53bfeb8417c0b28207

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:24

Target

59c85e5380c1c823d6f7aded38b8ea2426234428e17b9e53bfeb8417c0b28207.dll
Size

6KB
MD5

7b339694e4424f4fbe7ad3cd2c625120
SHA1

ed271dae7b570549fb2db1b8aee22edf4bd9d801
SHA256

59c85e5380c1c823d6f7aded38b8ea2426234428e17b9e53bfeb8417c0b28207
SHA512

7963bb5a6ac5b308397aa4c51a5a50485a3e24bf70955aa379637ad99dd80a81bb277858ca3217bbc9d24773199637188af3cdd771cb2b50bbf77cdc7a11fded
SSDEEP

192:WtqKR6bgYIgR6zXxnuc1CBpKzHC6t3Yhk5j3V:WtcIXgcEnwx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59c85e5380c1c823d6f7aded38b8ea2426234428e17b9e53bfeb8417c0b28207.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59c85e5380c1c823d6f7aded38b8ea2426234428e17b9e53bfeb8417c0b28207.dll,#1
  2⤵
  PID:1536

memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download