5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:27

Target

5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll
Size

70KB
MD5

7a0f74a69477e6c3d1a02c9b78e6af30
SHA1

1f581be8d406fe29590551968ba33d910fd5f028
SHA256

5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01
SHA512

77233587b5e83a591cad1fa0d846af6d2769713c83d3f9a966676aa3021fdf63c2ac635d6c1c23fdbe86d7dcc2e2789dd93959f8b912c49db6e47ac26fdfeb6c
SSDEEP

1536:Bm1NGJVGDQEWWi7CmoB+cP/PUJisaq7oZVWr3oIw93Bg:kX0VfnWsAwcPEJisNWVtIURg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll,#1
  2⤵
  PID:1308

memory/1308-54-0x0000000000000000-mapping.dmp

Download
memory/1308-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download