13e57610c4805dda4c1acf2de76b6715d64b4eb6b9ef0b6bf0afd5cf834dfbed

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-12-2022 06:15

Target

13e57610c4805dda4c1acf2de76b6715d64b4eb6b9ef0b6bf0afd5cf834dfbed.dll
Size

16KB
MD5

ce2fa305d50943c31d5b3e59a7aa362c
SHA1

8a3a4da4bbd5b84d158293eed156eca94179c63c
SHA256

13e57610c4805dda4c1acf2de76b6715d64b4eb6b9ef0b6bf0afd5cf834dfbed
SHA512

96fdbce77f8d19abe1259d58adc15ea6325a7d5aec61b4d8705764cef9cd494167de129a87ac900a69bc13f9f4df906b77b60be67499b2e86c2c2b8894cce7d0
SSDEEP

384:ZONLg914I6zogz2y0sCuj4jjjBQnDaeD9KvR:Zeg91Q5CLuj4jjjB5eE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27
PID 1204 wrote to memory of 1196	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e57610c4805dda4c1acf2de76b6715d64b4eb6b9ef0b6bf0afd5cf834dfbed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e57610c4805dda4c1acf2de76b6715d64b4eb6b9ef0b6bf0afd5cf834dfbed.dll,#1
  2⤵
  PID:1196

memory/1196-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download