44d9480844ffd6455b8a40290df989ac8441b00d05b4a2d888124c6d42b0a7f1

Analysis

max time kernel
14s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:32

Target

44d9480844ffd6455b8a40290df989ac8441b00d05b4a2d888124c6d42b0a7f1.dll
Size

86KB
MD5

f75321fd3eb54e69527193ee06e842b0
SHA1

b0ff7f3738026b8cf4ccc302e0e136ea214e892a
SHA256

44d9480844ffd6455b8a40290df989ac8441b00d05b4a2d888124c6d42b0a7f1
SHA512

c6306c8ba272c88be48095b951e4cdba4c41c8163e98984add9a31eebacf32e7017b37f70e69784ab9b089894d542451ee0cd2ce1d7128a8e625998dbf0abad8
SSDEEP

1536:k27YDGlCwnzyfwsCVvpoTpnEOyHs27YDGl6Hbq:uGYwnzyfwsCV+VXyHGG8HG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d9480844ffd6455b8a40290df989ac8441b00d05b4a2d888124c6d42b0a7f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d9480844ffd6455b8a40290df989ac8441b00d05b4a2d888124c6d42b0a7f1.dll,#1
  2⤵
  PID:1116

memory/1116-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download