c4451fc5f6c11cf34207479899bb30f39a20b21dd1317497a22ddb1d5cf2e757

Analysis

max time kernel
232s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:07

Target

c4451fc5f6c11cf34207479899bb30f39a20b21dd1317497a22ddb1d5cf2e757.dll
Size

60KB
MD5

69711b7dec0590111e3dc1744134a7a0
SHA1

79ef108183882e9b0c2dee568735c310db090d19
SHA256

c4451fc5f6c11cf34207479899bb30f39a20b21dd1317497a22ddb1d5cf2e757
SHA512

82f67b293083e6dcc74c34986e13f7a9192739b44cb7346f75e77b3c79228aa7b25436f624d2c8063fbacbc5a003edff76d6e2a460387d6cb24a26efa25589cc
SSDEEP

1536:PPXEmAiRm2VfvmNFnToIf6HTRLar5Z/NrWK:n9Vfv6tTBfoTRLar5Z/NrWK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28
PID 892 wrote to memory of 1872	892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4451fc5f6c11cf34207479899bb30f39a20b21dd1317497a22ddb1d5cf2e757.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4451fc5f6c11cf34207479899bb30f39a20b21dd1317497a22ddb1d5cf2e757.dll,#1
  2⤵
  PID:1872

memory/1872-55-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download