5e6d595161ebc12e0f937251216890f086a1a6240dbdd245b25eccd86076833a

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 17:51

Target

5e6d595161ebc12e0f937251216890f086a1a6240dbdd245b25eccd86076833a.dll
Size

7KB
MD5

354685819bbc24739544399d02702cf0
SHA1

d00daf3bbdee56aa280572f53dc6c3be78b01b34
SHA256

5e6d595161ebc12e0f937251216890f086a1a6240dbdd245b25eccd86076833a
SHA512

0c8293529a613dd0fa003b294e0b0cbb8498484d496fa054de4ac7d52cb9d1d28d158ce9d8235201e31407ddf3b7993bb42f9b6d3ff8318f0826be1dcd19fe14
SSDEEP

96:z0JgPtJrYHVjGwd+SP0vQfsHPUeuOBQtGj8jZ7+7HFpr4PWbbjQF:7oiS+PIs8U6Gj8lWprsWbX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6d595161ebc12e0f937251216890f086a1a6240dbdd245b25eccd86076833a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6d595161ebc12e0f937251216890f086a1a6240dbdd245b25eccd86076833a.dll,#1
  2⤵
  PID:1472

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download