d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:44

Target

d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll
Size

49KB
MD5

5af910ea274a620f8cfae5ad673a9712
SHA1

41cd6f0ec800ae719010669d9174a95a38ccdd12
SHA256

d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c
SHA512

cfda0d7fca6813dc40cc800edaaf055731804b6b66fcb277aa44bf45bf23c85fd5ccf50db026cfa90e228536198655f478b05998d93dcb87eadfea7a8fcb2d52
SSDEEP

768:nbY4lC0ZU+0+fljdCtfgz2BFo78q9Y2PjLLtlxRL8PKgl0:EGjSUljdCtfId8qC2P/LtFL8Pm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28
PID 1888 wrote to memory of 1716	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll,#1
  2⤵
  PID:1716

memory/1716-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download