c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:50

Target

c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll
Size

33KB
MD5

6998b705ace78ebcf55c6729d310d99c
SHA1

90d1e9a4a7bc6a20c989d3822f4fb336077b7e1d
SHA256

c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954
SHA512

891e3143bead563a97cada0b0f008e45ade5e8c72b8f9a09412ed07a7442d05e172fbccc536caa49ef0d5301740dc8179fc926468581c3a1208aaef50148bc54
SSDEEP

768:G5C39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+X:G5wgAEw0kY87EWddgWk+Rd+X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll,#1
  2⤵
  PID:1516

memory/1516-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download