d0a115d050c59f8d3b4c265e8c2287ef6299029ff116a47182f40f8f351bec81

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:36

Target

d0a115d050c59f8d3b4c265e8c2287ef6299029ff116a47182f40f8f351bec81.dll
Size

54KB
MD5

10b502cd49fce3b3e1af0e4123252f21
SHA1

4f00a16310b32beb1687b38575d06a1454e2d324
SHA256

d0a115d050c59f8d3b4c265e8c2287ef6299029ff116a47182f40f8f351bec81
SHA512

043c6f137e57ee65ef6702a9d921a5864e26acd932d44d6514cbacf32e17a65d19d232c590a30bb896d73cad10df2c363ac7ebc956828822494c22b8151b1867
SSDEEP

1536:23umoMtxe5ZYxoYQIAFJVAmaW9rqTc+gGBH007E59LzWoO:CoMtxeRYQIAHOm/9OTc+10WklzWoO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28
PID 2008 wrote to memory of 1252	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0a115d050c59f8d3b4c265e8c2287ef6299029ff116a47182f40f8f351bec81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0a115d050c59f8d3b4c265e8c2287ef6299029ff116a47182f40f8f351bec81.dll,#1
  2⤵
  PID:1252

memory/1252-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download