a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:27

Target

a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll
Size

34KB
MD5

61d44f1d358fb18ae4a37ba1ddd67ba0
SHA1

a5cb51503e3d3260e1a8e58e182e417687c4c1c9
SHA256

a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756
SHA512

451159ca1c579693b7f74b00a5651933236c1ec46fb51c2d8cc41a405e20b4e378c0d559dff5dbe3566e0a0f5ef383bb9f05fe311eb25aaf0434c26fd22fee77
SSDEEP

768:R7mRDL0cgngbMzSJOQc7S/DftqqhnP0RROPx:9mRD7gHzS0d7S/1pMRROp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll,#1
  2⤵
  PID:960

memory/960-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download