f353f20db52558ede58cd64ffbc3cdec483d2f1171d790e7549878bf7ab394a1

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:44

Target

f353f20db52558ede58cd64ffbc3cdec483d2f1171d790e7549878bf7ab394a1.dll
Size

6KB
MD5

36866a36cf2fae5e740592cd0ba29ed0
SHA1

53daab06f81acf5078c5a228b6a0794edb804262
SHA256

f353f20db52558ede58cd64ffbc3cdec483d2f1171d790e7549878bf7ab394a1
SHA512

77a530b05babb3038042dd1ec1b424c6923871a5120f6c7fb95565e7bd68a02c316c218e8cc3434e7a7ffde78a1f060a5216a8db220f26b8ab3d8049f205f9b8
SSDEEP

96:nEY2RrF1eqwi4lxHLJjXODk2P8q2SLubXnY:EHRh1epplxHLZMk2P32SLUY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f353f20db52558ede58cd64ffbc3cdec483d2f1171d790e7549878bf7ab394a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f353f20db52558ede58cd64ffbc3cdec483d2f1171d790e7549878bf7ab394a1.dll,#1
  2⤵
  PID:1744

memory/1744-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download