f5364e2157eee1c5477cf00e50e58fe59ed6bc661e7af93cd8660585f8af3a33

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:56

Target

f5364e2157eee1c5477cf00e50e58fe59ed6bc661e7af93cd8660585f8af3a33.dll
Size

73KB
MD5

2132369bb55253840ce3e1084e33a990
SHA1

66458e6f51341b84d89bf5273aee7bc5e9db1145
SHA256

f5364e2157eee1c5477cf00e50e58fe59ed6bc661e7af93cd8660585f8af3a33
SHA512

c7e9d38a1f3bce3d85bf344c58e673bf3ddd2d33b37b33aad29d25266036fb4ec3af6028d3047bfba01eb4461ffbefd1119b511de6cd650a2c742a345b0d71d2
SSDEEP

768:75si9P5l2+NHt/Bl5GPSqlMIW/BWqYsGc+d7h2Io/1f+Usw3EvWVi66zhMgxPkG:75NlNNHHl5mtmBWXcVImf+Usw39XAyG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27
PID 896 wrote to memory of 1108	896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5364e2157eee1c5477cf00e50e58fe59ed6bc661e7af93cd8660585f8af3a33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5364e2157eee1c5477cf00e50e58fe59ed6bc661e7af93cd8660585f8af3a33.dll,#1
  2⤵
  PID:1108

memory/1108-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download