50502075e4babb79e8507a96e3fed47afd040a8e3cbdd02f202ad3e76f439858

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:50

Target

50502075e4babb79e8507a96e3fed47afd040a8e3cbdd02f202ad3e76f439858.dll
Size

5KB
MD5

7f8c584022f39e924f7eb18358662410
SHA1

9743ad59879653ac4cf199533332a2b114a29e34
SHA256

50502075e4babb79e8507a96e3fed47afd040a8e3cbdd02f202ad3e76f439858
SHA512

0f0b7f5b4fa68e3ed5c7a0448685d703bfff0ba583b17494aa02d10c706dd0ffb6f0f374aed291b37b7031b42b0a808527c296a0bea53f15906d98c84a9f9938
SSDEEP

96:nEY2RrF1eqwi4aAG8PypVc/z/BoCksvPxc+g:EHRh1epp77PybcbksvG+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27
PID 1808 wrote to memory of 1988	1808	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50502075e4babb79e8507a96e3fed47afd040a8e3cbdd02f202ad3e76f439858.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50502075e4babb79e8507a96e3fed47afd040a8e3cbdd02f202ad3e76f439858.dll,#1
  2⤵
  PID:1988

memory/1988-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download