5c4068efd33510c73a20c492570224d8d02c946c0de38d985e8c2fedf009d2d5

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 17:28

Target

5c4068efd33510c73a20c492570224d8d02c946c0de38d985e8c2fedf009d2d5.dll
Size

18KB
MD5

9efc251bc11b5b8dba92874085d6d090
SHA1

54947d130fda675ceb02b621dcef08ea83322e32
SHA256

5c4068efd33510c73a20c492570224d8d02c946c0de38d985e8c2fedf009d2d5
SHA512

43b067a2496c863bdcb2c74e7a1cd77b16d39e7ef258ec6af96c5d8452b5850af003d74ad210486193895c7c88e0a9bcd406c48f207fd301f70da2ea2f425806
SSDEEP

384:NrDKFb+tnPWjtLf8zvh/wBQvJZgo0vivV+Mf:RqatnPWjtLfUYOvHgdv+VTf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4068efd33510c73a20c492570224d8d02c946c0de38d985e8c2fedf009d2d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4068efd33510c73a20c492570224d8d02c946c0de38d985e8c2fedf009d2d5.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download