7b544733cc1189c839023a50dc3c8bec17ca4c4975b4a205083b2286faee0bdb

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:22

Target

7b544733cc1189c839023a50dc3c8bec17ca4c4975b4a205083b2286faee0bdb.dll
Size

6KB
MD5

52400c13c95818682c893f99a71fd560
SHA1

f27328b73a66a41af8eae8e4005f83debe0e7ccb
SHA256

7b544733cc1189c839023a50dc3c8bec17ca4c4975b4a205083b2286faee0bdb
SHA512

3b7811733d1ac4fc03ed06e9073f84e10ffdf755a129f66e69d69632783923450d90099bf25fbe6adff2f9ce9ed9edb484daa467839f12a41fc35613ce8b9d44
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROQOQKP5h+Wa+iy6JrJUPAzj7J:YXEb+pbYox

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b544733cc1189c839023a50dc3c8bec17ca4c4975b4a205083b2286faee0bdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b544733cc1189c839023a50dc3c8bec17ca4c4975b4a205083b2286faee0bdb.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download