29860049319abff5b6dc4e7846a5ed0388ba081a7df80f3857c6542a7bed4db3

Analysis

max time kernel
26s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:26

Target

29860049319abff5b6dc4e7846a5ed0388ba081a7df80f3857c6542a7bed4db3.dll
Size

113KB
MD5

b413ac69d6bc4c4a7364d495951fc4c5
SHA1

bd4cb4f4bdd117ef37838540fbf11e2579d240d7
SHA256

29860049319abff5b6dc4e7846a5ed0388ba081a7df80f3857c6542a7bed4db3
SHA512

a8d56a15f25ffd35876688073ff2ca232ce73627937b496e02b0cf54138d984835bc5cb50f2901c7caf2c672197594f7e5ceb6efc32ec2a656224b3dfc9bb1c7
SSDEEP

3072:d5DXBfoDs52WY6iCIr6xC+fy69JAGVIKx:rXBfoDyFvxxdJAGVV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27
PID 1228 wrote to memory of 840	1228	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29860049319abff5b6dc4e7846a5ed0388ba081a7df80f3857c6542a7bed4db3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29860049319abff5b6dc4e7846a5ed0388ba081a7df80f3857c6542a7bed4db3.dll,#1
  2⤵
  PID:840

memory/840-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download