533b7f887ccce21fc08127941066dc86b19209d220caf25f21751487ec0fef9a

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:39

Target

533b7f887ccce21fc08127941066dc86b19209d220caf25f21751487ec0fef9a.dll
Size

4KB
MD5

4400655488524816823ec41dcd8dd560
SHA1

3e665c0733fb6339b48c8bc60d5bcd32b11721f3
SHA256

533b7f887ccce21fc08127941066dc86b19209d220caf25f21751487ec0fef9a
SHA512

e085ed76f39f6dd3b571409ef7e2628ada8996d082be8722f3aa279bb951643a3d0bf78a4a32eedeef7568232fa90b7e202ab20b34b63541b8c88a19e19113fb
SSDEEP

24:eNGS5k4V4cW3Ce8WG/QPVGRVtq44MBZlZVtQ58kwVIaH40RWIcVqoqRGpHMD88Wj:a5zjMTGcITBVQVE1lcbq1OkFio0w0V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26
PID 1640 wrote to memory of 980	1640	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\533b7f887ccce21fc08127941066dc86b19209d220caf25f21751487ec0fef9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\533b7f887ccce21fc08127941066dc86b19209d220caf25f21751487ec0fef9a.dll,#1
  2⤵
  PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download