58763f0a1780d901f643b60ac07005f2e29765a2f06a6af872c946959f5e97f1

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:36

Target

58763f0a1780d901f643b60ac07005f2e29765a2f06a6af872c946959f5e97f1.dll
Size

5KB
MD5

e04f2a660f3ecff5e3541f33db1004a0
SHA1

50a42db4d379bae630bb162c482aa0842d3e5d2d
SHA256

58763f0a1780d901f643b60ac07005f2e29765a2f06a6af872c946959f5e97f1
SHA512

86247601ada2efc79b259d8466e027cd19f74b05ffec00cdc999682f25dbba09f78d78a0dce044fa186547eea3fc35cb760439285545494fe949421d32f1125d
SSDEEP

96:FtrRdrY0x7+PZ5UCaz8y9W8bIOoU3HnR:Ft11+PUzfW8bj3x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24
PID 1812 wrote to memory of 972	1812	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58763f0a1780d901f643b60ac07005f2e29765a2f06a6af872c946959f5e97f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58763f0a1780d901f643b60ac07005f2e29765a2f06a6af872c946959f5e97f1.dll,#1
  2⤵
  PID:972

memory/972-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download