053b66014ac11e96e7b8c3b35ee0b2e2de5d6af626cb7b46eb54661365cd69a5

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:59

Target

053b66014ac11e96e7b8c3b35ee0b2e2de5d6af626cb7b46eb54661365cd69a5.dll
Size

723KB
MD5

fc37ed0602b814572ee1b83e14f1f740
SHA1

4b28b0bffe02512f3c5bd2e3cbf4a7572f5dd9e4
SHA256

053b66014ac11e96e7b8c3b35ee0b2e2de5d6af626cb7b46eb54661365cd69a5
SHA512

7ac5485e2df71bdf3f95d1ad2a44995a92269c8ef5dab15d26a99701358cf241c34b70af7d9e8424682f41c0c9523ddcee62cd5b0b3fc11add675b80f8fb425e
SSDEEP

12288:i4M1K5JqVUWqY/HqxpJagJvq8NVbKD2L:vMw58fqYSxGIk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27
PID 884 wrote to memory of 1100	884	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\053b66014ac11e96e7b8c3b35ee0b2e2de5d6af626cb7b46eb54661365cd69a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\053b66014ac11e96e7b8c3b35ee0b2e2de5d6af626cb7b46eb54661365cd69a5.dll,#1
  2⤵
  PID:1100

memory/1100-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download