c950a76e0eb3fb2a4cf22bc2d10ae88e15364d5a50b7634b47df6b8c71d06658

Analysis

max time kernel
15s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:27

Target

c950a76e0eb3fb2a4cf22bc2d10ae88e15364d5a50b7634b47df6b8c71d06658.dll
Size

54KB
MD5

82e69cafb73a71bd6f43f5def92c23e0
SHA1

81c017363489bab454777e3375842d7e48826765
SHA256

c950a76e0eb3fb2a4cf22bc2d10ae88e15364d5a50b7634b47df6b8c71d06658
SHA512

b278a594a69eb483421b61c5b7b46bd80d650f99dc120eaa290393b443397ba63b1d430c653b3653e42b0e3d2ca72b917e108c5568af63c2fde448f6d5640def
SSDEEP

1536:Bm1NGJVGeCXDWzhfWRPNn1F9JoORVKsNkQGSy3Bp:kX0VvrzcdNn1FrbbKWH7y3Bp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c950a76e0eb3fb2a4cf22bc2d10ae88e15364d5a50b7634b47df6b8c71d06658.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c950a76e0eb3fb2a4cf22bc2d10ae88e15364d5a50b7634b47df6b8c71d06658.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download