d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 07:00

Target

d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll
Size

8KB
MD5

ac2b9d88b5148172e35c50d98131072b
SHA1

dcc392c8b545190d45bbff6544b629bf4ec0328a
SHA256

d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be
SHA512

9dd9d63811501d31efd58576e9593c0aa875e871c8f4525a570ecbc1b25ddb89866a10bb36f2c2afb5db07c037b50e7b1a91fa5f4ac7d777c854dd4d8204d65a
SSDEEP

96:H8JHxN1Sg1iO4tnx2J7Ku+8oJjt12CJccL5ywHwbvW94/B:cJRNIIiJnxUK38y1+WkvW6/B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27
PID 996 wrote to memory of 952	996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll,#1
  2⤵
  PID:952

memory/952-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download