4569eeb1edd26fdd7f17b77ba3b463c293dabe8450463df135f0df6e5114b556

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:06

Target

4569eeb1edd26fdd7f17b77ba3b463c293dabe8450463df135f0df6e5114b556.dll
Size

4KB
MD5

5d136d896d605cc249b526f406850910
SHA1

809985b034f74f661ff6477f3331de2b3ac31bb8
SHA256

4569eeb1edd26fdd7f17b77ba3b463c293dabe8450463df135f0df6e5114b556
SHA512

9875ca4f618e8bb37e2b9f4110963630687000462ca9184a1c3fe798c7d600fe066002675a0ba92fce10c3fd14c399fe22924ed8fdae2c1fd9e4c4d03e97593e
SSDEEP

48:Ss0FkQ23grztJrhWRHnVjG5a4Uh+cxDwsgyc2xcHLG3+VcK:z0WgPtJrYHVjGwd+SPgOeLGOl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28
PID 1908 wrote to memory of 1952	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4569eeb1edd26fdd7f17b77ba3b463c293dabe8450463df135f0df6e5114b556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4569eeb1edd26fdd7f17b77ba3b463c293dabe8450463df135f0df6e5114b556.dll,#1
  2⤵
  PID:1952

memory/1952-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download