5a3039adacd04d69ba71a9a90b1f5f1462b92451e94184495c9f878b05394984

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:56

Target

5a3039adacd04d69ba71a9a90b1f5f1462b92451e94184495c9f878b05394984.dll
Size

57KB
MD5

6960a10b9872b20bcdf3aef21b205e19
SHA1

23ad936f575bc47303a9b74cec61d1497a0f0dca
SHA256

5a3039adacd04d69ba71a9a90b1f5f1462b92451e94184495c9f878b05394984
SHA512

435cc9fa54d37743d58c9c3ca55baf84ec39e8946ea519768be3a93bceb77009b4371ff1df2382b3a62db93441ee1ba7d29acfb579bbcb20c739d107135cb98e
SSDEEP

1536:evoPgB6i5qOaXhsVeYbwg3szp9C7AJw9cwg:xg15hS+VeYbwg8zpHJwHg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28
PID 1208 wrote to memory of 1008	1208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a3039adacd04d69ba71a9a90b1f5f1462b92451e94184495c9f878b05394984.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a3039adacd04d69ba71a9a90b1f5f1462b92451e94184495c9f878b05394984.dll,#1
  2⤵
  PID:1008

memory/1008-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download