57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:07

Target

57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll
Size

6KB
MD5

ac58c4dfdb244b2936ea6edf7707c640
SHA1

aafc44fff3f192e45ca7ed53f3570a206a7d8055
SHA256

57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542
SHA512

49fe472f22ba0e78ba2653285a8f0e682ebc2e5e878a5548693d2523c385d7edf07144179564f76e00dc768f9b1c056eb1c2acd5f64545618c1d70943defa80d
SSDEEP

96:nI2RrUeqnFvjny4v63JZobBIXf9i4vgP/bKZoIa+/GWF9K:XR4eD/50BE9inP/0N9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27
PID 1880 wrote to memory of 1020	1880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll,#1
  2⤵
  PID:1020

memory/1020-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download