55496ab339477cc5862f7dc4c38d8c76aedd39a607f3e5ae5cb428a16eae7947

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:05

Target

55496ab339477cc5862f7dc4c38d8c76aedd39a607f3e5ae5cb428a16eae7947.dll
Size

76KB
MD5

4544e1fc3bc73de5f20c2bfa8c2040fa
SHA1

a5c66c363cf36fdbd5fe5da6980aa6f1936786c0
SHA256

55496ab339477cc5862f7dc4c38d8c76aedd39a607f3e5ae5cb428a16eae7947
SHA512

023260670f401261fecb128004f14f9a9e8506a9020c4b4d9ce1cf5d387b319b7ed1c4b76a051472f351efc2e3e6342b0fb5fd2faecf7d87728a2ce1372d68ca
SSDEEP

1536:PQC0WsVbga1kbub+DZXKoruTqXDkEs/7nPyKhRsM+t1nx:YCaVbFCubeuTmDkESnPFz+t1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28
PID 1016 wrote to memory of 1756	1016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55496ab339477cc5862f7dc4c38d8c76aedd39a607f3e5ae5cb428a16eae7947.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55496ab339477cc5862f7dc4c38d8c76aedd39a607f3e5ae5cb428a16eae7947.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download