52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:10

Target

52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll
Size

6KB
MD5

7f2f9e13bec52fc8af9fe9f454052390
SHA1

6126ab911b52377c709c2206320a5c0a40821162
SHA256

52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573
SHA512

e196e0cf8b6b59e6db1d220b9c25b1fe4bd9d0ad07b88f2610c2c05b360014cacd8bc86452f0eac9871920baf77a040fc2ad2af539652d383c35f2e6a84b4843
SSDEEP

96:ng92nrwQ0eqnOxk6nTsuxD2R5RL9TAF7h/j7kC69CXut4/KAahxwm2fjMk:/neeRtn7l25tuhHmAX1KAwxwlf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#1
  2⤵
  PID:1896

memory/1896-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download