c5d32b0d8d47c6434263eada5ac1a0a53282f2a1d405901da9d25b81896135ff

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 19:29

Target

c5d32b0d8d47c6434263eada5ac1a0a53282f2a1d405901da9d25b81896135ff.dll
Size

54KB
MD5

5ff5f386ec84810df07e8b2a1e6f8940
SHA1

cce8b40a8879b90c1df7a508ef501262695a643b
SHA256

c5d32b0d8d47c6434263eada5ac1a0a53282f2a1d405901da9d25b81896135ff
SHA512

b793caf1936d805fdb2fd1b539a5f629a370a99be126a0885da87cdc69c8b5113d7565d264ad0cfaac995c56458d9df5618aad8faed399c33c5e16e1fc687a55
SSDEEP

1536:mPO6KEVbsVP0gD9UmLbQLxWro8HrmhlxCAFBE8yc0FEoE3:cMEVbsVcSUQrPHrmhP/Nyb0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27
PID 1092 wrote to memory of 1612	1092	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d32b0d8d47c6434263eada5ac1a0a53282f2a1d405901da9d25b81896135ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d32b0d8d47c6434263eada5ac1a0a53282f2a1d405901da9d25b81896135ff.dll,#1
  2⤵
  PID:1612

memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download