5830210b6b267b2e7bbea5cc295238bdd0a8362ec013c20f56d88f5fc4fcfea4

Analysis

max time kernel
156s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
02-07-2023 12:43

Target

nanodump_ssp.x86.dll
Size

34KB
MD5

7bd007883059c6385dd4788c578d7aef
SHA1

251addc5b302d2a20950036d0a6a72f8332cd591
SHA256

5830210b6b267b2e7bbea5cc295238bdd0a8362ec013c20f56d88f5fc4fcfea4
SHA512

411b3755d362849ca26b59b819e58cb9bf55f6f5d1b20ecc620f61842338e740797c3159fafd394cfbdc1f4938b41d5a72cbdc8aa3670e8971c0aadac2e7f773
SSDEEP

384:3huaJT5MJGjb+hwvgdIDifmKaN9HPIR9hbzKZSoCOrSD8oTzfbEgFecpH:9T5LbSwvgdqMK1sKZkJYgQtkH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26
PID 1252 wrote to memory of 1240	1252	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nanodump_ssp.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nanodump_ssp.x86.dll,#1
  2⤵
  PID:1240

memory/1240-54-0x000000006C880000-0x000000006C891000-memory.dmp

Filesize
68KB

Download