962a5b7ac32c4958ccb4a4409b41361045d426ba0ffb7efc584f5d021d2f953a

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:37

Target

962a5b7ac32c4958ccb4a4409b41361045d426ba0ffb7efc584f5d021d2f953a.dll
Size

4KB
MD5

56d73d2b4244cc5bd4af35eb38b961c0
SHA1

1669837d9c542e4d632782b7a417d5e71e66137d
SHA256

962a5b7ac32c4958ccb4a4409b41361045d426ba0ffb7efc584f5d021d2f953a
SHA512

9b7ea32bc76be1cc98813d9da77abae772afd335113b3039b83bef5926c31f389409ab77dc87f69a074ad701c4ba538a086c0326141c8ec3526496ca9e177c81
SSDEEP

48:a5zjMTGcITBVQVE1lcncsE3rSbjRRLv1y6DRl0xC1YV:iT3Qu8csK+fLv1tl2l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\962a5b7ac32c4958ccb4a4409b41361045d426ba0ffb7efc584f5d021d2f953a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\962a5b7ac32c4958ccb4a4409b41361045d426ba0ffb7efc584f5d021d2f953a.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download