45280cc136af790f8ec67f65c37600323e371e960aa5fa5efb8fcbed14fe5784

Analysis

max time kernel
220s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:58

Target

45280cc136af790f8ec67f65c37600323e371e960aa5fa5efb8fcbed14fe5784.dll
Size

55KB
MD5

0ee03918b73380d23b8f2dc44cc8e7e0
SHA1

db7a4761e80a91377873af31b6e273f40c101932
SHA256

45280cc136af790f8ec67f65c37600323e371e960aa5fa5efb8fcbed14fe5784
SHA512

5c31c6d7e5e0fb5e50af1fb64ca3662d301be431eb0c7e33c9d877e12487839aefd1e1db1905133e5593ce446e353d987b111c9ea21526d5325de90e48229724
SSDEEP

768:M5SOT1bJLb+lxoTifw/CrAfbkhjiZtdFSoXApVfgYKjsEP9gBQHmmaogurpRm:MSOTJhKlx7fw/lfwsugYKjr9m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28
PID 568 wrote to memory of 1528	568	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45280cc136af790f8ec67f65c37600323e371e960aa5fa5efb8fcbed14fe5784.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45280cc136af790f8ec67f65c37600323e371e960aa5fa5efb8fcbed14fe5784.dll,#1
  2⤵
  PID:1528

memory/1528-55-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000000180000-0x0000000000196000-memory.dmp

Filesize
88KB

Download
memory/1528-57-0x0000000000180000-0x0000000000196000-memory.dmp

Filesize
88KB

Download
memory/1528-58-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download
memory/1528-59-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download