b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 22:01

Target

b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll
Size

31KB
MD5

7a9a8fd7fc3b406194e58f39e7720010
SHA1

5538596379d0a46c1f0c17a29b7b1cade982e7d2
SHA256

b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0
SHA512

7b7914fc9a048c799857ed077c3ab6a5c4e624243e437f44a7b00661e23df46a2b55503637939bb62e45532a350b3dcda5093fe430d000742c67a19b32ce8585
SSDEEP

768:qYJWA1CqWe0PamHQ267tM/AChqDERIE8vB:vkA1kPamM7tEhkYRIE8Z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download