1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b

Analysis

max time kernel
4s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:17

Target

1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll
Size

64KB
MD5

e46ec5df50f2cebf3034ca12fff7ae30
SHA1

c7a2ef358693cf2c2271644279c9a45f4f8dbfe7
SHA256

1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b
SHA512

ad5b747a8ec65755058a004b1fc2dedbe61a4631c2f2dbd246d9b661543b839fb21bc0f4bc416df6fbe8613e49463a4133f947e4b1854ada028002764a374cca
SSDEEP

1536:5jRmOWn9CFJLxojbpigb1UWgMJAP94ucWo0NB6h:xfjNoj9igbbUz6Z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28
PID 2028 wrote to memory of 2024	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll,#1
  2⤵
  PID:2024

memory/2024-55-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download