59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74

Analysis

max time kernel
31s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:24

Target

59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll
Size

7KB
MD5

989316154fa503aa279e486b7dffe240
SHA1

0d84f736b70927dfc3c1420bdf67241bf3c66746
SHA256

59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74
SHA512

1c8d61fa0e30989acf327b5e3d345b4614ec3304b9d0391b7d7e73a831d50142bb26de2ca553fa8227165bbb4016b0a55a872af223dbad1f2a22300d33bed582
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIEyHG+zyD16K0/ny8V52V6GVLlufDg7vndk+YgQZ0sW:unSR6bgYWXD5DG2uZW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28
PID 876 wrote to memory of 1908	876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll,#1
  2⤵
  PID:1908

memory/1908-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download