f51cb5e831b485b187b9d36b8a6fb74db69887e6842485a5f870734eb282920f

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/01/2023, 18:47

Target

f51cb5e831b485b187b9d36b8a6fb74db69887e6842485a5f870734eb282920f.dll
Size

96KB
MD5

6c7304a9ba06b9567585829ce2088ed9
SHA1

02330a41ed4af95aea5633c4f8a01dc11098943f
SHA256

f51cb5e831b485b187b9d36b8a6fb74db69887e6842485a5f870734eb282920f
SHA512

862252965424f93e75a229122ea5e970595c9fb40a4d8f29c4cabd6efa7ea1d6324cd2fa34d3e5267b734e809266acccf7d5b4e4c15c5dc98cd27f9db7798d7f
SSDEEP

1536:DG04IfGS4JDp3Pts0xZNDkKZZBWfdt3kVUFLhUVoQ4BrZ0Q/ZT:DGLIfGZxpfa01dZZy3kVUbUVoQmZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51cb5e831b485b187b9d36b8a6fb74db69887e6842485a5f870734eb282920f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51cb5e831b485b187b9d36b8a6fb74db69887e6842485a5f870734eb282920f.dll,#1
  2⤵
  PID:1116

memory/1116-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download