a28d407eeab22c6891a4538a73288438e420967507e6bb610bbcd029c1fb0e76

Analysis

max time kernel
59s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:35

Target

a28d407eeab22c6891a4538a73288438e420967507e6bb610bbcd029c1fb0e76.dll
Size

7KB
MD5

537249bf636e7ace5423fcbe546ca190
SHA1

b0bb71e58b2e4e5c7c6cc7ffcf34de486ee7c420
SHA256

a28d407eeab22c6891a4538a73288438e420967507e6bb610bbcd029c1fb0e76
SHA512

eb995eca9d928cb467540a0b0997d42f7c34f37015a688fe6f4843244df407d597a5df46e13afd25cd60b8b224205077f0465f2c5e5344012ebe0289187aebcd
SSDEEP

96:WLRxkjujtjd8jPjcZG2Uo/5wxDs++ZSV9MLFZooeNHz4TbyCWKpm:WtqKR6bgYIWxDs+SSLMLnWz4TbyCP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28
PID 316 wrote to memory of 1852	316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a28d407eeab22c6891a4538a73288438e420967507e6bb610bbcd029c1fb0e76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a28d407eeab22c6891a4538a73288438e420967507e6bb610bbcd029c1fb0e76.dll,#1
  2⤵
  PID:1852

memory/1852-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download