5ab443f61d2dc5e8170bea9c58b884d5f832be2ea04339bf1fb9d34204cc3408

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:21

Target

5ab443f61d2dc5e8170bea9c58b884d5f832be2ea04339bf1fb9d34204cc3408.dll
Size

80KB
MD5

6da665a35de101115faf569eb8c08b85
SHA1

845278276c4c373bdd68c082f862c4dd362ef9e1
SHA256

5ab443f61d2dc5e8170bea9c58b884d5f832be2ea04339bf1fb9d34204cc3408
SHA512

b97e3001fd9020748cf109da417692eca16cee16a15e18f613dcf708329072abc27350ce56482082cfda2623559f857dfbd27f28a9c089298b03ae478454d622
SSDEEP

768:3D76Oa8GwUUpKbXWUfLwajoSrbIuiNQFTZRfcXI0NbUve3b0iB9v5vz+WNYxlm1C:zcSbKbBDtozGFTT+I8UC7SkYeoz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab443f61d2dc5e8170bea9c58b884d5f832be2ea04339bf1fb9d34204cc3408.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab443f61d2dc5e8170bea9c58b884d5f832be2ea04339bf1fb9d34204cc3408.dll,#1
  2⤵
  PID:912

memory/912-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download