4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 06:15

Target

4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e.dll
Size

538KB
MD5

d83341fb5ec8ab2ff744f607f26fed14
SHA1

acf3de133d0d60b17cbb0e2f7f1bec602fd03571
SHA256

4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e
SHA512

0e4361b3830efc02e88942abfa11124a18a95536cd2dafbe7720e078196761412e53c7a25b500b8233f121489830f3a0f6307bdff03253b0c746274bd0b191a3
SSDEEP

12288:2hPiwTlG2+8BWY3FlSm9tTfkGmyYvcJNr6uB+R:I3nBWmIGmyDuB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27
PID 1544 wrote to memory of 1140	1544	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e.dll,#1
  2⤵
  PID:1140

memory/1140-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download