59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:06

Target

59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll
Size

6KB
MD5

303dbf9a22655f9e24e5bca8598bb030
SHA1

da67f9a03328c31c76ba5c08175be73579285051
SHA256

59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c
SHA512

a4752078cc2219d7a2ed4a6ceebe8989049b99ac6d030b0cc9402908a8a46d48c380a98ad2b95df05fa83ad542e413fcaa774c584f06ac52f9aaeae57dc05509
SSDEEP

48:StLHOj98/a6xkklS4zklStklSd8klSPklSTIZGjiiDlGYocf:WLRxkjujtjd8jPjcZG2Uo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download