5e60cf0702dd90deee6a9725f0bdf983468cc56b753ca5562f4c1a22ea742371

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:04

Target

5e60cf0702dd90deee6a9725f0bdf983468cc56b753ca5562f4c1a22ea742371.dll
Size

6KB
MD5

cfca0566c7d91cafc65403a1150c1dd0
SHA1

3c8e1e2572d868e1e913577ab3fc8fc29000549e
SHA256

5e60cf0702dd90deee6a9725f0bdf983468cc56b753ca5562f4c1a22ea742371
SHA512

627f60bd74d31304a0a5990db93b2bcdb82c1e04695159f034374da0d93b5a8831204dc9b529ab750e2198ef6dc23b9dcd99a7db4f72a93927c48091e94bf5ca
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRO/GFMAmqQx5HzWmg3Ai6I:YXlV1QxkBQjI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e60cf0702dd90deee6a9725f0bdf983468cc56b753ca5562f4c1a22ea742371.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e60cf0702dd90deee6a9725f0bdf983468cc56b753ca5562f4c1a22ea742371.dll,#1
  2⤵
  PID:2044

memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download