244bbb8145a87a0c36a2e23d6c808e7b608eb8ab9bcff4a2d8f6aa54605941a8

Analysis

max time kernel
45s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:18

Target

244bbb8145a87a0c36a2e23d6c808e7b608eb8ab9bcff4a2d8f6aa54605941a8.dll
Size

62KB
MD5

5feed7ef238fed54c7bdec9d34666110
SHA1

53a09e99969b60c2a4cd08155f6328e1c0c31317
SHA256

244bbb8145a87a0c36a2e23d6c808e7b608eb8ab9bcff4a2d8f6aa54605941a8
SHA512

2c3c13d0f32acf740308509679be0e9a48167359a95a8e465a910dc6783d0a19af444b2910ee91bb4698f145341de857b1dbe3fd1fbef72f0ac10756acf2d6ef
SSDEEP

1536:2LOJMXV6Q0E3Vu/Hvbzue5IJWVW+DosCsCvCH:2rko4HbieEMJosCU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\244bbb8145a87a0c36a2e23d6c808e7b608eb8ab9bcff4a2d8f6aa54605941a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\244bbb8145a87a0c36a2e23d6c808e7b608eb8ab9bcff4a2d8f6aa54605941a8.dll,#1
  2⤵
  PID:1552

memory/1552-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download