628f358674eb90011d4844b4ca601bf15b3530ff04bd8f77c2b323da17dd1292

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 05:15

Target

628f358674eb90011d4844b4ca601bf15b3530ff04bd8f77c2b323da17dd1292.dll
Size

16KB
MD5

eb4d5afaf42af3504edb857afaaa6161
SHA1

15019c360428dfbb321b2874a975ec1363cfe8a9
SHA256

628f358674eb90011d4844b4ca601bf15b3530ff04bd8f77c2b323da17dd1292
SHA512

db31b0c48afd891b71ed98dd2ba4e26b02c357d7e00ee465c96ad0a9eecbd56d6cdf4adac07ad5a0cc7e17bea4c3daf0e3ac00b3d0993f35ca4c00e056f9251f
SSDEEP

24:e1GSgDSEhpCglIB6SXvVmMPNjvhBrDsqZ:SgDzllVImgNNBsG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628f358674eb90011d4844b4ca601bf15b3530ff04bd8f77c2b323da17dd1292.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\628f358674eb90011d4844b4ca601bf15b3530ff04bd8f77c2b323da17dd1292.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download