4f5f046d8682f8f729ee225a66d958de2d4ea319ce844136344252f39cc4e460

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:51

Target

4f5f046d8682f8f729ee225a66d958de2d4ea319ce844136344252f39cc4e460.dll
Size

4KB
MD5

edf9eea5ffb05124d46331442c787d80
SHA1

c1f9efd44c510062ed1b143cd0f9e6a1b20896c2
SHA256

4f5f046d8682f8f729ee225a66d958de2d4ea319ce844136344252f39cc4e460
SHA512

8ef9d90ce55a9925917ac133e823cb6c2496514d26d166dca932cffba0ce7fb76d1524438530fe72baf614548b2df552a297a2183885848691bdd9f8aa81bdf7
SSDEEP

48:qHupGeMcCB96DrhWHR0FiIsipZlM+u+eAPMDQHpyuLv6omxvoRS:PMXB0rw0MI/pwbdZAg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27
PID 1560 wrote to memory of 1920	1560	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f5f046d8682f8f729ee225a66d958de2d4ea319ce844136344252f39cc4e460.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f5f046d8682f8f729ee225a66d958de2d4ea319ce844136344252f39cc4e460.dll,#1
  2⤵
  PID:1920

memory/1920-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download