88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:24

Target

88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll
Size

62KB
MD5

fd96d49117c8ae5d2022b595729b4ff9
SHA1

56e907ef5d09de2ad192ebcc531ecbb17076e327
SHA256

88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b
SHA512

d3d2e55a2bea44aecbbb673732938757f13ed8f8787e7771b0199a542f42f1fc932ea403ec60422e4c38c25a79e20a79a44ac84a6bbbb49aa435203c25243438
SSDEEP

1536:yHZB03+ERkw2tmAxRkzjd68EC3Bm+avWeUHm:yHf03+ERkFtmZzEAB8vWeym

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll,#1
  2⤵
  PID:2044

memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download