5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:19

Target

5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll
Size

72KB
MD5

5b46792ce15c0b165352d84a1be10520
SHA1

243188005b69aa43ca5f34818a94b8c77f57e792
SHA256

5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c
SHA512

af373cb3aba76e6e540d3bfab29bd8d69a14d33909fb5db2234dec3ae0941d260d4fa4e0ccb62e3267a7f68a9b520efdd3a6afae4eca1b69e0d4a05a413b6b45
SSDEEP

1536:yHZjwYOryu+gJxpWJHHeah7jql8A39KrHCJTZZp8:yHFDYJxyHh2CwZp8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll,#1
  2⤵
  PID:1076

memory/1076-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download