e5b48272c65de8fea0e4b4b4ae1f0338ab5a2c5664caaeae9e8a6c1d81c28cae

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:18

Target

e5b48272c65de8fea0e4b4b4ae1f0338ab5a2c5664caaeae9e8a6c1d81c28cae.dll
Size

136KB
MD5

47e4247e493701fc325a4606296012c0
SHA1

f8c9cd0a58f431d2a50f474068ddb722753a8542
SHA256

e5b48272c65de8fea0e4b4b4ae1f0338ab5a2c5664caaeae9e8a6c1d81c28cae
SHA512

959968fd8dff145913be4f2192795a163d14cc8fc24ed54462ba64c81dd37baf4fd8f5408b70e00379f15b20deed58519b9e2518f01efce511c419451e5152a0
SSDEEP

3072:M8wA0/MPNtg1ygFG6XQ0/syVpILTQygewGOog7j0Imt:M8wuPQJ2tukgk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27
PID 1124 wrote to memory of 912	1124	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5b48272c65de8fea0e4b4b4ae1f0338ab5a2c5664caaeae9e8a6c1d81c28cae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5b48272c65de8fea0e4b4b4ae1f0338ab5a2c5664caaeae9e8a6c1d81c28cae.dll,#1
  2⤵
  PID:912

memory/912-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x0000000000150000-0x000000000017B000-memory.dmp

Filesize
172KB

Download