5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:28

Target

5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll
Size

5KB
MD5

c7149a707db8a358c7e1ea1bf5dc8cd0
SHA1

35e59e1d6706c1d88817a587bff76c2c3bc3af67
SHA256

5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a
SHA512

333b8b312bd3fbf771ae49a938766de52d76dcf7c8f610e7edd017520bf2123c0162e3bf941f8f6f7483306083aee91b160d6c6f61c12a960901d468c228d98a
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaialRFr:XUcA+ggd+W/If0ier

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll,#1
  2⤵
  PID:816

memory/816-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download