a56c2c1b42077fb46325b42b41766439b86425e7c87ffb19e973f043e82a2436

Analysis

max time kernel
33s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:46

Target

a56c2c1b42077fb46325b42b41766439b86425e7c87ffb19e973f043e82a2436.dll
Size

57KB
MD5

83587c7cbafc57b4968541360989c254
SHA1

352fc4007cb87fc8feb760a020d91415b0807f66
SHA256

a56c2c1b42077fb46325b42b41766439b86425e7c87ffb19e973f043e82a2436
SHA512

75623ae5e1bd361446c3a8041ee3c9fd709912736b3b1f650884e161ab53b46e87cca66eefabf5a6031787684769d9d180bdd20d29d16995d7c275047ac92371
SSDEEP

1536:qmmMnFyROKmB8FQjCyO5HEpsebog1uue9iB7wtU5+jnPU:QMnFyRO/ZjCfEhboLue8B7w4QPU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a56c2c1b42077fb46325b42b41766439b86425e7c87ffb19e973f043e82a2436.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a56c2c1b42077fb46325b42b41766439b86425e7c87ffb19e973f043e82a2436.dll,#1
  2⤵
  PID:1376

memory/1376-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download