5cce1e478c9861cf0e1d8b69ac065e73951aa9729bc60cfe6f35a839bd9dc3c2

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:06

Target

5cce1e478c9861cf0e1d8b69ac065e73951aa9729bc60cfe6f35a839bd9dc3c2.dll
Size

28KB
MD5

dbe8502eac676e2e7a1db5c229957957
SHA1

328df18d52530464e6e4d05f6edc295fe09ad3a9
SHA256

5cce1e478c9861cf0e1d8b69ac065e73951aa9729bc60cfe6f35a839bd9dc3c2
SHA512

291637e30de4b042e1a485e757b64464a204fecc3e5164e65f1b26175a29a0169a9a0d60811038692e141ec2cf717c33f3c69a023f537e5f4519b16022c5b4a5
SSDEEP

384:HntodYSo1b3M3kqMUdhWQbnmGZcrk17Ha8PHQUUGDnFK:HtodYHX/EnZ4k5HxhUcFK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cce1e478c9861cf0e1d8b69ac065e73951aa9729bc60cfe6f35a839bd9dc3c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cce1e478c9861cf0e1d8b69ac065e73951aa9729bc60cfe6f35a839bd9dc3c2.dll,#1
  2⤵
  PID:956

memory/956-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download