5dcd07ab93faa79e2e6aad53e9c8440cf740f5de390e0cc3780541520387150b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 03:41

Target

5dcd07ab93faa79e2e6aad53e9c8440cf740f5de390e0cc3780541520387150b.dll
Size

2.3MB
MD5

0101afeef08d7c91bf8568c02c712ea3
SHA1

b9dcbd31640c520e8672a454496d4a6ec212f7b3
SHA256

5dcd07ab93faa79e2e6aad53e9c8440cf740f5de390e0cc3780541520387150b
SHA512

4d3005b967240214e7acc5ee4c796edde3c71d3e5586752da91b7cdc1ae5e544e26e6f4e508d1d98a1f4ab3ad94e1b8057e4bb388890b093bc5b49a968125271
SSDEEP

49152:mg8kQtIB3vYaUDWNzd1ReHmTWXXRFvyL889d/2/VXXaYSW:m3aB/sDq1R8VDvN89xmH7SW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28
PID 2684 wrote to memory of 2576	2684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dcd07ab93faa79e2e6aad53e9c8440cf740f5de390e0cc3780541520387150b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dcd07ab93faa79e2e6aad53e9c8440cf740f5de390e0cc3780541520387150b.dll,#1
  2⤵
  PID:2576

memory/2576-1-0x0000000010000000-0x0000000010244000-memory.dmp

Filesize
2.3MB

Download
memory/2576-0-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2576-3-0x00000000022E0000-0x00000000023F0000-memory.dmp

Filesize
1.1MB

Download
memory/2576-4-0x00000000023F0000-0x00000000024E5000-memory.dmp

Filesize
980KB

Download
memory/2576-5-0x00000000023F0000-0x00000000024E5000-memory.dmp

Filesize
980KB

Download
memory/2576-7-0x00000000023F0000-0x00000000024E5000-memory.dmp

Filesize
980KB

Download
memory/2576-8-0x00000000023F0000-0x00000000024E5000-memory.dmp

Filesize
980KB

Download