e50b58641bea6709c2b28c20627eb594e51cae2000a4edc0367ccf2ec140b867

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:42

Target

e50b58641bea6709c2b28c20627eb594e51cae2000a4edc0367ccf2ec140b867.dll
Size

6KB
MD5

c13882fa50269a0a4abd97be0ac6f100
SHA1

e41c0e4473fd98885bda6f54a1a0ea6cf9f58097
SHA256

e50b58641bea6709c2b28c20627eb594e51cae2000a4edc0367ccf2ec140b867
SHA512

d7408dc04e2a1c92f9e147fd162ca67f431bcec0a385661748295a877c6d518d678676f40a2c158622b88ace1ca32b1cc4dff07911d21aa41ee5f3f04ed0c9b9
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhQ:nEY2RrF1eqwi4K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e50b58641bea6709c2b28c20627eb594e51cae2000a4edc0367ccf2ec140b867.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e50b58641bea6709c2b28c20627eb594e51cae2000a4edc0367ccf2ec140b867.dll,#1
  2⤵
  PID:1604

memory/1604-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download