ec52b6b1dfbd51beaba921f10d9c900b97f3ea30e616293ae30a5aeb3301864c

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:30

Target

ec52b6b1dfbd51beaba921f10d9c900b97f3ea30e616293ae30a5aeb3301864c.dll
Size

497KB
MD5

bd837dc1a60b6bb2aa5aa028f6328445
SHA1

85e594c8f3d9277d5d6e86fbd7b989ffd6a7d99d
SHA256

ec52b6b1dfbd51beaba921f10d9c900b97f3ea30e616293ae30a5aeb3301864c
SHA512

27254918233a0d6b86dc27fe4fafa6aab39ef921c42e9f28b571f5b513a2f29775c384bb8023cd7e5bbaa866e4736a3f02841cf4563c8387b606fcc5a1891f56
SSDEEP

3072:rqpYA+Ws/VZG+zRAHiOe2dbEIkaW+2tqvqNSAmNWQV0pbQXbmKR7Ef7:OpY3WsdZXzRrXMbEFmeSr8qWKRQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28
PID 2032 wrote to memory of 484	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec52b6b1dfbd51beaba921f10d9c900b97f3ea30e616293ae30a5aeb3301864c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec52b6b1dfbd51beaba921f10d9c900b97f3ea30e616293ae30a5aeb3301864c.dll,#1
  2⤵
  PID:484

memory/484-54-0x0000000000000000-mapping.dmp

Download
memory/484-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/484-56-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/484-57-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download