161502e91d14052f89f78139762eba587d4901d6deb1666d47163fb4c4a4855c

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:19

Target

161502e91d14052f89f78139762eba587d4901d6deb1666d47163fb4c4a4855c.dll
Size

5KB
MD5

5e46bf1fc6dfa3ff413c854e5c59b110
SHA1

1ff5f4ba5e61bfb151fab66fd7a214da175694df
SHA256

161502e91d14052f89f78139762eba587d4901d6deb1666d47163fb4c4a4855c
SHA512

64330d81a3306d554d8fc96d56adc1a9743ff1178f2ce36a7290c4528a2bf9d1cff8d889263c78227baed81070939d0dbbb4d73de21049628fdf7855a2e02b56
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgIGJXv0WxUhrAkHyJWpNOWCNIoQB1EYckdySC:nI2RrUeqHBvRUdAkSgpYXC1ckdyE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\161502e91d14052f89f78139762eba587d4901d6deb1666d47163fb4c4a4855c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\161502e91d14052f89f78139762eba587d4901d6deb1666d47163fb4c4a4855c.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download