cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb

Analysis

max time kernel
5s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:40

Target

cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll
Size

30KB
MD5

6d532e38dc5f6a9dc2c74aade1aa111b
SHA1

84a38f20c26890d3848dac86fe83592289ac1799
SHA256

cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb
SHA512

e25458507f49e87af70aa674c73b50d170da0b24f47bf463127cd8505ba409c913750a6ffb6dbfeeb320d72dba900ecef8822dcaace8f3402c11fcc0bf4124b6
SSDEEP

384:Lm5S1+/I4gZOJAzA4yxRJ5by77AzOgGtepeopxUawPJFJUFfSqEyVIDv:ig1+w4HJOqxRjy7QOPtDWUhhDomDv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll,#1
  2⤵
  PID:952

memory/952-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download