a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9

Analysis

max time kernel
26s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:11

Target

a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll
Size

5KB
MD5

d3067312f1b3888055f1480b22f24730
SHA1

24f5747874117702db73ba0f9d6154f9166e8c37
SHA256

a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9
SHA512

011895fcaa9857f10eaac97b674e2c772b63f50d57729942f9f4fecbeaf4bf3176c6811a370b0388e47393c18fd264eefe2c7bd53106897617f8923f0e44cb25
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiVi:XUcA+ggd+W/If0ii

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28
PID 1376 wrote to memory of 1644	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll,#1
  2⤵
  PID:1644

memory/1644-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download