de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:13

Target

de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll
Size

4KB
MD5

12f5cb3a1de4c84a796d0402715d8040
SHA1

6ce94724519de536a59980496dc4b31a80c5c1d9
SHA256

de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be
SHA512

e8dec11f45444c38fee21b7eccc046cd3576bb1d415b55ba00b54e4651d3241190667cffd386f423ad5e4941867e8902f83e7a50ef39a38a1da8b85ba40e9180
SSDEEP

48:SWkO0IoyTnXz+ihZjokcZp6B1R2/Iba8EokxD:ZJTnXzvokB7R2/IbeokB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27
PID 536 wrote to memory of 916	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll,#1
  2⤵
  PID:916

memory/916-54-0x0000000000000000-mapping.dmp

Download
memory/916-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download