a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 10:01

Target

a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll
Size

18KB
MD5

65fa16830c1978e0071569b9fe453210
SHA1

02bb124f75177a0d1a22df37a1297188e1b6c0db
SHA256

a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b
SHA512

037d0b8c7e9048b9311c31eec90a4674c4a603f7bcdc3bb675f3b3f4fca1b166893f5f5ac2505578420e67071cb00ce7cc70e6906a872836a717a104e003f142
SSDEEP

384:zB7eaC64Zz0skzUmwCrzWIAmUBCiY6IH6zrVRnB7wB9/VV9o0viI89E:zB7e3Z0snmwCWIAgiY6IHGrvGD/n9dv9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download