559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:38

Target

559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll
Size

142KB
MD5

5b4b8a0a4c4a8da5bcba1f29f5d9e578
SHA1

87d6c3638c8365c666adfe69ca7477da4a241b43
SHA256

559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819
SHA512

3478e680d93aa4d6f50b3db47b5dd91316573633cd4b1c37d9a8e8bd78124b6da6bb578e820d6e57539d89780e6cdbb67155f9d0ee14fc13b005914a85f2e895
SSDEEP

3072:KG4SNpL0ymEgn3G5vY8dc1C4xXXfHs0ySe7yVyWr0z8gsC:K5SNpXmEgn32vYWc4IHfySCy/r0z8E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28
PID 1452 wrote to memory of 1712	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll,#1
  2⤵
  PID:1712

memory/1712-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download