a78153091d3e2cdb8833c2c80f63feb3c1987e614c398747dac8cad50bac2f5f

Analysis

max time kernel
20s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:32

Target

a78153091d3e2cdb8833c2c80f63feb3c1987e614c398747dac8cad50bac2f5f.dll
Size

33KB
MD5

ca5eace8be7e44df8a99695e236909d0
SHA1

d26afdfeb87bdb5e18245f45fd27dddb8e8e409d
SHA256

a78153091d3e2cdb8833c2c80f63feb3c1987e614c398747dac8cad50bac2f5f
SHA512

657a7106e19248c79f3d619c5f887506316b4f1ef0dd80521406e86804105b2705f9de23c4398b153a51ae687144691ff3972c30671dd584029f7764e9099b07
SSDEEP

768:NNk/x8KMHeZbc5kgVnJs7tfYEUNVOx8RA3sgWa6:bk/xdMmgVK7xYEeZRLdv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28
PID 1516 wrote to memory of 1584	1516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a78153091d3e2cdb8833c2c80f63feb3c1987e614c398747dac8cad50bac2f5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a78153091d3e2cdb8833c2c80f63feb3c1987e614c398747dac8cad50bac2f5f.dll,#1
  2⤵
  PID:1584

memory/1584-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download