31797338c6c7e69abcb243e56c64c2af9efaf69735110d4b45a43b28a0f5ad8a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:32

Target

31797338c6c7e69abcb243e56c64c2af9efaf69735110d4b45a43b28a0f5ad8a.dll
Size

4KB
MD5

89c4065ba6ce434e06ea2d1a7fb4f050
SHA1

9dca93cea38944ba49f6444290433ff03921f548
SHA256

31797338c6c7e69abcb243e56c64c2af9efaf69735110d4b45a43b28a0f5ad8a
SHA512

d769893a512093662bd99cda52a13600e6915508105679b8b2a5dc5de8efe05d1b2266b91c6227210f0952a86127770b1c2195e54924b0b5512f9f8a7ffd0101
SSDEEP

24:e1GSYL3CeLA9/kPVCRVtc44MnXz+iM2u8kypgyXwVQwA3HdQzWMpuQbstzovr66M:SKLA9oyTnXz+ihZjujLb+7MxfiIQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27
PID 1896 wrote to memory of 2024	1896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31797338c6c7e69abcb243e56c64c2af9efaf69735110d4b45a43b28a0f5ad8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31797338c6c7e69abcb243e56c64c2af9efaf69735110d4b45a43b28a0f5ad8a.dll,#1
  2⤵
  PID:2024

memory/2024-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download