51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:48

Target

51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll
Size

54KB
MD5

1a0f8ad10e7e952993e08a1e3f918cd2
SHA1

425a9d62e8b61a0de10dd150832e3eb5e0e6016c
SHA256

51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554
SHA512

0104aec94436b73bc6f6a2c6065daab9d8c22565fb18901264270b191a643642ea0d50fb1d943ca0c46355ddf1af9732df6ce54bccbedb7af1082b7c3714e65b
SSDEEP

768:eEf58XQOIw+9p6GTkhL5lO31nadzIUUTPEcRTDbeRQhpawapFmfMDvVqyR0QoKui:7k8760y2c4TEcRreRw0wwvVqyaUu1lrW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28
PID 1096 wrote to memory of 1384	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll,#1
  2⤵
  PID:1384

memory/1384-54-0x0000000000000000-mapping.dmp

Download
memory/1384-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download