c5a56e4d90ccb3346bb0cc8451cb5777fd61941257351465bbeb540570f94ffa

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:10

Target

c5a56e4d90ccb3346bb0cc8451cb5777fd61941257351465bbeb540570f94ffa.dll
Size

60KB
MD5

e368ddb8feff43f620a5872f3f69eb13
SHA1

e9b26dee2ea8c6b06585b8bb41b1ad776d1c91e7
SHA256

c5a56e4d90ccb3346bb0cc8451cb5777fd61941257351465bbeb540570f94ffa
SHA512

42da02baba10bbc567725d9c602ccca49ba69de7b6bcdb89dbd7c692e867a1122c1cc2076b2d4b8038913e5a9150778600e9633a598bc2a1d1592353ff5b272b
SSDEEP

768:2QAP0pjDkLqnZiV95gtTqpT1mFnEYzgEiB9bx7bm7vh9RkELoBV5l9p5tNJ:2QA6jEq/9qpT1iMrC7p9RoD1pHNJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27
PID 892 wrote to memory of 1900	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a56e4d90ccb3346bb0cc8451cb5777fd61941257351465bbeb540570f94ffa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a56e4d90ccb3346bb0cc8451cb5777fd61941257351465bbeb540570f94ffa.dll,#1
  2⤵
  PID:1900

memory/1900-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download