93e5569ae915ed693cad31829a0d02cfb5a768816d2276245ea932c0a0b75a79

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:03

Target

93e5569ae915ed693cad31829a0d02cfb5a768816d2276245ea932c0a0b75a79.dll
Size

5KB
MD5

67c8ea6ed91e81be2159d9d0eb7dbad0
SHA1

81dec62f8d5bd10db626d7110c6d29c1e000a600
SHA256

93e5569ae915ed693cad31829a0d02cfb5a768816d2276245ea932c0a0b75a79
SHA512

ed45b991ab9079701dac8c9a9ec3e8e7cf47163422352d4e7bd53e82a51d35d2b2885b135cca52e0c1e9b5a7c2a064d15778543ba49c4067b521987c0e86225f
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXruV4bv6j:1h9jTqMMrY0OI/KYyznSMG4bv6j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27
PID 884 wrote to memory of 1120	884	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e5569ae915ed693cad31829a0d02cfb5a768816d2276245ea932c0a0b75a79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e5569ae915ed693cad31829a0d02cfb5a768816d2276245ea932c0a0b75a79.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download