c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0

Analysis

max time kernel
23s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:56

Target

c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll
Size

36KB
MD5

8b6d73c8dbfd4234abe407cdfca186a0
SHA1

2e321e34e93aa18fcee25156a08ec9e3a29e59c2
SHA256

c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0
SHA512

8278e6a4e251e5687a149396ceb05f10fb7bff8aad91c17327bfbbeda55c06b08ea1a0f7d8254c059dcec8095195b4b57ff473f0a60a72ace1f50fbb7e83303f
SSDEEP

768:hldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROgx:hjjeUJ73PRtuVq67F9lQgROy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll,#1
  2⤵
  PID:1884

memory/1884-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download