577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:30

Target

577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll
Size

5KB
MD5

31c563e8f65c3b642945abeb92b31d20
SHA1

d8adc5d8c9679840dacff9d85b9fb0e8b3f6c2ac
SHA256

577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791
SHA512

b98ae8ac89ab0ef31cdeab62f459d13142d4505237a49865dd25ec9abffb924aa94ba014097710062f34e78eb231bf4e2a3b73f00bcfb655a9c0e5a11a4afd26
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiHRSF:XUcA+ggd+W/If0idRk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll,#1
  2⤵
  PID:996

memory/996-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download