de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:58

Target

de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll
Size

7KB
MD5

7131c877c42a71e34451d3ca424ca7a0
SHA1

1add473ee9663ef02549a89c74f007a4ed02da85
SHA256

de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1
SHA512

d892ca150bd01f7b8e4c5f9f7856bf7cc863d70cfbd8bc36132b6789b5e375d93317827400969bd32f8a9fbdf570d36af862894ca5900fcf1b954bc6274263a6
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRO1Hj2gLNYEdWD8PEvl2:YXQbp3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download