96d51b1361c04a6003a769fe897049cfca5171768a94cc5635eb811fd2ca2e82

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:52

Target

96d51b1361c04a6003a769fe897049cfca5171768a94cc5635eb811fd2ca2e82.dll
Size

6KB
MD5

5a1c3139e91b84e8ee7b5dc8c12d0320
SHA1

a844e42deb34d6b6bed4c124ba8637e54bb7e98f
SHA256

96d51b1361c04a6003a769fe897049cfca5171768a94cc5635eb811fd2ca2e82
SHA512

b01ad7d5b7e1d43b396f235f30ab43a0933625287f36e4c4736956b2a69067a306e13fb4978d57470aaaddf7683934ca58ac8f439fba3f166ba85044c08bc9b7
SSDEEP

96:nEY2RrF1eqwi4Rs5rE5EcKaCKUApMJaxDWG+T1b1dDP6:EHRh1eppRfM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96d51b1361c04a6003a769fe897049cfca5171768a94cc5635eb811fd2ca2e82.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96d51b1361c04a6003a769fe897049cfca5171768a94cc5635eb811fd2ca2e82.dll,#1
  2⤵
  PID:1348

memory/1348-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download