d49e402cd30985dde81933e18cebec3e0602a16dee610bc2e97a4b50c67fbfed

Analysis

max time kernel
4s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:16

Target

d49e402cd30985dde81933e18cebec3e0602a16dee610bc2e97a4b50c67fbfed.dll
Size

7KB
MD5

0cf96817baca8bc8cb4723fc2d3502a0
SHA1

e08488986d9b60b81d65aa418a89fc81fc17f0f0
SHA256

d49e402cd30985dde81933e18cebec3e0602a16dee610bc2e97a4b50c67fbfed
SHA512

a00def6295b1f6de7bd9e85c9ae03cfb824f22392bdcc033b812b676ea4f2e484acc6bd5deeea5eee9ccb5794720487d6bfaa9e9bd962fb5c30a1e169d5de876
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROskpa2IMPj+aBuqJ39crhgTycqLa8:YXBaa2dL+aYqJ39crhgOcqLa16qS7N

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d49e402cd30985dde81933e18cebec3e0602a16dee610bc2e97a4b50c67fbfed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d49e402cd30985dde81933e18cebec3e0602a16dee610bc2e97a4b50c67fbfed.dll,#1
  2⤵
  PID:1776

memory/1776-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download