5730d7eb4f0c6cf7d9a133897e5c7d52672a2b81945f1ad32b98d3d42f6f703c

Analysis

max time kernel
246s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 21:32

Target

5730d7eb4f0c6cf7d9a133897e5c7d52672a2b81945f1ad32b98d3d42f6f703c.dll
Size

34KB
MD5

7bd28e3a961ea8ad3e90469d0646d880
SHA1

ecd46c34fd9cf33ffeb25eada7d09e8204a811cc
SHA256

5730d7eb4f0c6cf7d9a133897e5c7d52672a2b81945f1ad32b98d3d42f6f703c
SHA512

3d6ea52281c25fbfab085faa0fdad5886ffd620b6f9b14380fa471c467647f66aa070b187fd530a38686abe8482cee5b584fff0a27bfd6cbd4aad307da6713a3
SSDEEP

768:eHhSzibNPn5f5dYQ7dCguH+sIIJGrw+RZ:eBKiFn5f5r7dCguH+sLIDRZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28
PID 1740 wrote to memory of 1716	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5730d7eb4f0c6cf7d9a133897e5c7d52672a2b81945f1ad32b98d3d42f6f703c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5730d7eb4f0c6cf7d9a133897e5c7d52672a2b81945f1ad32b98d3d42f6f703c.dll,#1
  2⤵
  PID:1716

memory/1716-54-0x0000000000000000-mapping.dmp

Download
memory/1716-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download