11192cb5bd62408a485fd67d380a93d0e1916ca555f72d255fcea78ad02d5efa

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:32

Target

11192cb5bd62408a485fd67d380a93d0e1916ca555f72d255fcea78ad02d5efa.dll
Size

5KB
MD5

fa76e83ba878a79993a802c219ff9f60
SHA1

ff866d50611e17f59630ec959df3975bffe29d7b
SHA256

11192cb5bd62408a485fd67d380a93d0e1916ca555f72d255fcea78ad02d5efa
SHA512

a84e8d140ae090178a9915939bc6321749b92617959301a03c5b1364f1be6959c940294c8ee39ee597b6992643ddc344fe96c0c7b5268cbbd9293e31ad3c07e3
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iain9XX:XUcA+ggd+W/If0iPH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27
PID 1092 wrote to memory of 1676	1092	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11192cb5bd62408a485fd67d380a93d0e1916ca555f72d255fcea78ad02d5efa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11192cb5bd62408a485fd67d380a93d0e1916ca555f72d255fcea78ad02d5efa.dll,#1
  2⤵
  PID:1676

memory/1676-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download