54229bc12aac572df8596a0e2cf33e10f0eb714e5bd8870c6dd58323f381dd87

Analysis

max time kernel
22s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:34

Target

54229bc12aac572df8596a0e2cf33e10f0eb714e5bd8870c6dd58323f381dd87.dll
Size

11KB
MD5

8161a35488192c2fd9fb1a5655966bc0
SHA1

be2dd646b058098e866f577464d6f8d03d2c6e93
SHA256

54229bc12aac572df8596a0e2cf33e10f0eb714e5bd8870c6dd58323f381dd87
SHA512

02cd0d4f2f0c6d18e2aa4afc129a0f542296b375c694ca0be0248121b60af3b7f90a1fb43dd7a1adba82e6a5d8f0f3a5a345df56087d196b57559503652c0b0f
SSDEEP

192:+pt3VvHniadMMXdMnaJVTjoBnUQLXXzBDg2RaetRw/5LOB+9PyXg:uBVqwndMnqTjkNAKB2yX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54229bc12aac572df8596a0e2cf33e10f0eb714e5bd8870c6dd58323f381dd87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54229bc12aac572df8596a0e2cf33e10f0eb714e5bd8870c6dd58323f381dd87.dll,#1
  2⤵
  PID:1776

memory/1776-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download