5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:57

Target

5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll
Size

6KB
MD5

8395cbc74f64b89ac8c506229d6b85d0
SHA1

0f26be30ba662cf25e9dc01fdf27196bd6b9c9f2
SHA256

5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac
SHA512

94092071fa699978c9341ac4205eb1ac31789060ae7634e3b98d0d2034027483aeb16557a6c8630c9acac3b183e88080a3087bc9612467b70bdeabb1b7cb633a
SSDEEP

96:nEY2RrF1eqwi4ajrry68ctUlZm70XYhNxI6EqcfrNRcCqrmr5s:EHRh1eppdusonaBDN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll,#1
  2⤵
  PID:1268

memory/1268-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download