5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:27

Target

5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll
Size

6KB
MD5

163fbb4ccabaf5cd24ad13aa4f87c6d0
SHA1

d70a35b2e2c24d135c1318f2cef00d190bc08b79
SHA256

5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592
SHA512

8d569fd07424bf294abd3e281c083e90ab52a327cbe016b568f967d42b91251ee81d73d320874f06d2e2f64b800dfb32f3439c0248babac21389f1e655a199b5
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNijWmNLfEC43sIDS0L79:PyIIjWXGhqNQLcC48IDS039

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download