55de61163c33698836202e9673351170f009cb4f775d69b1228d90cb6253276d

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 19:11

Target

55de61163c33698836202e9673351170f009cb4f775d69b1228d90cb6253276d.dll
Size

456KB
MD5

c1dd73deb9bb1a1a934cb1041cc67da5
SHA1

c8db94abe4666e9a43fee425f7f7c9d8a4c9707f
SHA256

55de61163c33698836202e9673351170f009cb4f775d69b1228d90cb6253276d
SHA512

5ffde13769a7bf627fad89ab1022fbbe084727bd0db05daff1c13e77a0966333686c43591d11f9c1dbfd96e47cf111e0058a474d4b7e9b4df7d2fadcc684a6f6
SSDEEP

12288:wpqhAvKP9TNLB7S9RhC0S7EIyBh2d+sNQKkY5zopL:MRv4l7+R0V7vyH78hpW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1200	1244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de61163c33698836202e9673351170f009cb4f775d69b1228d90cb6253276d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de61163c33698836202e9673351170f009cb4f775d69b1228d90cb6253276d.dll,#1
2⤵
PID:1200

memory/1200-54-0x0000000000850000-0x000000000096C000-memory.dmp

Filesize
1.1MB

Download