59bb159d52c210ce006b90e96390dec35b2056c962b80800644e38bb38d31e55

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:45

Target

59bb159d52c210ce006b90e96390dec35b2056c962b80800644e38bb38d31e55.dll
Size

5KB
MD5

25574901fd6b99780b4f0c173e59ee30
SHA1

0a467766c5bd10b089228ecbce19de3a7cb4357d
SHA256

59bb159d52c210ce006b90e96390dec35b2056c962b80800644e38bb38d31e55
SHA512

25e7a79395162bbdeebdcd511de33ff7cf3bf311344da4fa63fd73e2b706f158d2dd29df70f11c6d63e8197781c9431821e568315e27a1f8159b31147751c68e
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXruIRb:1h9jTqMMrY0OI/KYyznSMFRb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28
PID 288 wrote to memory of 748	288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59bb159d52c210ce006b90e96390dec35b2056c962b80800644e38bb38d31e55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59bb159d52c210ce006b90e96390dec35b2056c962b80800644e38bb38d31e55.dll,#1
  2⤵
  PID:748

memory/748-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download