40162e9f0f4e031d4df9457e507c90f012369b9375105ebc1757f052bafbaf7b

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:06

Target

40162e9f0f4e031d4df9457e507c90f012369b9375105ebc1757f052bafbaf7b.dll
Size

7KB
MD5

78af75828ca669dde105f69b399931f0
SHA1

089dd75902dda1e1fbff79dbbac9b1e16639aee4
SHA256

40162e9f0f4e031d4df9457e507c90f012369b9375105ebc1757f052bafbaf7b
SHA512

55aec41805d5b17b9f8d38842ba1b2666aae6295688ccfc798eecc524cb11c939db6f216421671ed671d018cd63567ab3ae029232b0424f04c3d0f59c8aefb07
SSDEEP

192:SoiS+OtMKRiIqaRndoDMI/BYA65ULNNnU:SOL5QD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28
PID 1648 wrote to memory of 1188	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40162e9f0f4e031d4df9457e507c90f012369b9375105ebc1757f052bafbaf7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40162e9f0f4e031d4df9457e507c90f012369b9375105ebc1757f052bafbaf7b.dll,#1
  2⤵
  PID:1188

memory/1188-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download