77549c9084569331511c5f38a1ee332095953cb25977c9d317bbe817acaaeedd

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:36

Target

77549c9084569331511c5f38a1ee332095953cb25977c9d317bbe817acaaeedd.dll
Size

56KB
MD5

5a9d7188a7d34c80c27f939882ad99f9
SHA1

2561eddc3b02253188047cc06831e36e17999695
SHA256

77549c9084569331511c5f38a1ee332095953cb25977c9d317bbe817acaaeedd
SHA512

48a082e102dc963ec337699a5d2c6ae95ad1bed9388d0d169aef5424c4bf18a922993d98a57762ae13323b08d8882949e19bd03c9c8668e8a70729732e0b2719
SSDEEP

768:h8WTpVT0X8zb7BmumtbQUUCI6VQ3ZRWw5tftN6mqd/Q3QNjU83jCvfbueujpdnEe:RVBmumnDVeZRfvVN3EgQRVsfNuz7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28
PID 1612 wrote to memory of 1508	1612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77549c9084569331511c5f38a1ee332095953cb25977c9d317bbe817acaaeedd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77549c9084569331511c5f38a1ee332095953cb25977c9d317bbe817acaaeedd.dll,#1
  2⤵
  PID:1508

memory/1508-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download