e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e

Analysis

max time kernel
37s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:10

Target

e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll
Size

4KB
MD5

ec85c726dcb2be90ce644c0a2c9ae530
SHA1

45d107eb14e89e2b5bd62cdd67502664ec3d538c
SHA256

e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e
SHA512

b2387620d129b618b1c0670e887c84b760312b908b2cddadf83d5ea6813ddb698ce94712cfc3ace57d3f714d1767a09e78e911ab052d3fa46cc793729df93669
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LpCqA03NU1kJK4D6zN+4v4sGtRo9oH9U:TRphMzf8sqAd1kWzsORGt/9U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28
PID 968 wrote to memory of 948	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll,#1
  2⤵
  PID:948

memory/948-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download