5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3

Analysis

max time kernel
19s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:47

Target

5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll
Size

48KB
MD5

3933a49fc55c4db6f2410db3789ec4d0
SHA1

82447e78eec71d1104ea6b292289f8c44e01fba3
SHA256

5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3
SHA512

0339994bae875d1dc0aeec270b2ed1541c6cbbb9657674d0bc13a1faa6a035b02aabac9b79d56095d82ebc6bfcda83beb540bddd09e51b317907c1aec6c45a58
SSDEEP

768:LgNTT4aHr3BH7zX7S5aWR6HF3hLP2FXKIuuzwJ:LgxXIaWoHFNP2cIu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28
PID 948 wrote to memory of 1928	948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll,#1
  2⤵
  PID:1928

memory/1928-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download