5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:30

Target

5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll
Size

4KB
MD5

fe7a8ffde0d9a77b9de993abb98eabd0
SHA1

b1370a599d90afd9c714defcbaa9af291edaf066
SHA256

5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409
SHA512

807c77ffabff1790507c18e186e180d73dc511d4d2f4948130c4bf7e5dd3b7930590acd1022da7f83a17481a515689b68541a32a4050dddb61e67a4412936a01
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Lngk9Z8X73vTShHzPhmu83t4INSY99Q:TRphMzf8dO73vTShbh3Y9Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28
PID 1972 wrote to memory of 1904	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll,#1
  2⤵
  PID:1904

memory/1904-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download