5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 22:00

Target

5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll
Size

2.0MB
MD5

14c154cdf50fa61941406ab3108b405b
SHA1

08e7d23cecc3560d9efbbd540a5428a587bb1531
SHA256

5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80
SHA512

eea68b90703690b6b8571c78043e0d65012f4613b5230dbb2c9160ab9963022dd29923e3a3cd646157daf0af59f42ca7be689cc6b774c0da71e7fd491f12a185
SSDEEP

49152:AedbI0oDAWZ+lBUFPsvRp9NGO3/tUvFyCGvR:Ak5pdlBU0aO3/8kn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 940	1712	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll,#1
2⤵
PID:940

memory/940-54-0x0000000001E40000-0x0000000002448000-memory.dmp

Filesize
6.0MB

Download