5ef2fe40403bdbff6ed32e4cfc77e9d2ec6618ea0ee2c2fa2356a70a52b69ef5

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:36

Target

5ef2fe40403bdbff6ed32e4cfc77e9d2ec6618ea0ee2c2fa2356a70a52b69ef5.dll
Size

74KB
MD5

93de72fe01ddc69cfa720d5c9ea78e41
SHA1

3869613a02ceb2bcd5774fb35c5e092958acd7b8
SHA256

5ef2fe40403bdbff6ed32e4cfc77e9d2ec6618ea0ee2c2fa2356a70a52b69ef5
SHA512

2725a4986fee4cf8cb255cb7ff2b7ca2a16c810eac2f737fa8ea4075134b2c0ac3fd720e2df0515ebb67925c2fc558c6c76b0de7ee96506167aa5e5dd7f3a36a
SSDEEP

1536:RVFuQlmWLKAR+pX9EnfqxV7AlSVOomGTQogt:TJhLKf8nStDzTQPt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef2fe40403bdbff6ed32e4cfc77e9d2ec6618ea0ee2c2fa2356a70a52b69ef5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef2fe40403bdbff6ed32e4cfc77e9d2ec6618ea0ee2c2fa2356a70a52b69ef5.dll,#1
  2⤵
  PID:1252

memory/1252-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download