b52d815d29ee41e0df9fb5d3657f31441b26a8342c97e92887ddf653b203af78

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:29

Target

b52d815d29ee41e0df9fb5d3657f31441b26a8342c97e92887ddf653b203af78.dll
Size

6KB
MD5

9900fa5612f128f3780e465ed99af6a0
SHA1

4757157f0f0bb9663932fcaedcc01a1ba67e9888
SHA256

b52d815d29ee41e0df9fb5d3657f31441b26a8342c97e92887ddf653b203af78
SHA512

950cab4242891ad885386c5181f8217553a35e982718cb453dae4136c76cca6eebeecfcdc0b5396e2cc684644da1d288d58568315105ba25af5f1748e2cdf628
SSDEEP

96:hy859x0P8Mal8D99MaFSNsMg7+84XLi/JgZefCF32nt9gsMf4UXKw/ZOe:F5oLOwzMa8WigU72o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27
PID 2000 wrote to memory of 1160	2000	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b52d815d29ee41e0df9fb5d3657f31441b26a8342c97e92887ddf653b203af78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b52d815d29ee41e0df9fb5d3657f31441b26a8342c97e92887ddf653b203af78.dll,#1
  2⤵
  PID:1160

memory/1160-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download