a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:12

Target

a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll
Size

160KB
MD5

74effce53e0f45d004f437c42a3b18b6
SHA1

94e9b6672bad0f11b2baf4d0c962bdb35b142f3f
SHA256

a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b
SHA512

72e6401de88e7f0cdbf1cd05acba58e3b4da48e2341bc33de6208b8b6e2d2995422bf06a694078af64354f4987ca6cb54f4dadb65ea895f8935d64d2ecaef88e
SSDEEP

3072:69d7aBDTeFHgWPrWqSnMMxjTdPDfBqBBwJkjxUYt:6P7DH1KBjTdLwHMQ+Y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll,#1
  2⤵
  PID:848

memory/848-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/848-56-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/848-57-0x0000000000130000-0x000000000013F000-memory.dmp

Filesize
60KB

Download
memory/848-58-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download