c537cfb142c6bf412232eaa15e3195c2a4cd3a4585b3bbae8528f4ac34d28aca

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:17

Target

c537cfb142c6bf412232eaa15e3195c2a4cd3a4585b3bbae8528f4ac34d28aca.dll
Size

75KB
MD5

30bd150495f6da2f1367dad05417a33e
SHA1

69f0db9b0215d88adcdcfe84e4861a9137ade597
SHA256

c537cfb142c6bf412232eaa15e3195c2a4cd3a4585b3bbae8528f4ac34d28aca
SHA512

be849d61c64ef7bc29c5d9ee94b98dbc0f97624e985afeb68261ea9ab92a59c42e88f21576b426a0c2994a9ed532a87dd5cbe115ef8a7aace9cd9e8c38dfec92
SSDEEP

1536:yHZ7SCrfEYh6POruzjs+niF4mCKrw0QymHIaSf001//Ey:yHpnstKrw0QymHIaRi3r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c537cfb142c6bf412232eaa15e3195c2a4cd3a4585b3bbae8528f4ac34d28aca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c537cfb142c6bf412232eaa15e3195c2a4cd3a4585b3bbae8528f4ac34d28aca.dll,#1
  2⤵
  PID:1460

memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download