3650a22b9f187270ce7007c04a2af35ba8d5239067f90901ee4ffa96fae3e67e

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 10:48

Target

a55d0c5be5767946dadbc41ff81edfe4.dll
Size

89KB
MD5

a55d0c5be5767946dadbc41ff81edfe4
SHA1

e61fa4151224e9946aaa9b80c04a4124584e6eda
SHA256

3650a22b9f187270ce7007c04a2af35ba8d5239067f90901ee4ffa96fae3e67e
SHA512

a88654a6f39ce1ee30358118bc7f18db048e13efbe9022b0c57c7fa2304944e64ec14113af56fb11b7d782402f71f8000b2f2d5dd345408e950eae8f37431c8b
SSDEEP

1536:To4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUsMOaB89p:ToUCWbBNpplToUs1uNhj25LJUsaB89p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28
PID 2028 wrote to memory of 924	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55d0c5be5767946dadbc41ff81edfe4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55d0c5be5767946dadbc41ff81edfe4.dll,#1
  2⤵
  PID:924