5aa5cae40648c974f4925b9e5641fff369aa55124fed872fb43d37e63b65680f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 03:34

Target

5aa5cae40648c974f4925b9e5641fff369aa55124fed872fb43d37e63b65680f.dll
Size

289KB
MD5

b99e102b86549db26a143403b3b4d163
SHA1

015117c377a5d831a7e475b3d039f04776fec886
SHA256

5aa5cae40648c974f4925b9e5641fff369aa55124fed872fb43d37e63b65680f
SHA512

2355ad11855e83e3892d0166a44f4b271a4e6c7cd39e9bb8f16e6619f7b7e508c6edfda4089798401e9d031cc1e843c719bbae7f155bad42643477c0daac3bf1
SSDEEP

3072:nCAhFE/DO2nnhWr/lLaiiD/9aTnM+a5/4vGG8jWMuHG:BhQOCnhy/l+79aW/4vrU8G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28
PID 1672 wrote to memory of 2424	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa5cae40648c974f4925b9e5641fff369aa55124fed872fb43d37e63b65680f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa5cae40648c974f4925b9e5641fff369aa55124fed872fb43d37e63b65680f.dll,#1
  2⤵
  PID:2424