bcf22bc84f83955d6cc0db650929c03a9187a52d98e6c47727bdfa42529c9e8b

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 06:28

Target

bcf22bc84f83955d6cc0db650929c03a9187a52d98e6c47727bdfa42529c9e8b.dll
Size

112KB
MD5

84c9f2968def1c54af04c32761bc421e
SHA1

8d7c469a507ca539715b1211dcd0d9e9cdc43671
SHA256

bcf22bc84f83955d6cc0db650929c03a9187a52d98e6c47727bdfa42529c9e8b
SHA512

162a91d3a4558b577659eed69e14accdbe9dcf2123bf44f9750165deb0ceb6a027a7a0bf1500b68fb9ad4aff2c3f448a619e80f50b40ffc594e67a2be03779ca
SSDEEP

3072:+gAG47YsyLGiB4Xu8Q5ddAPbbcSezwU861Iy:+gA7YsyyZe4PcVwFk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcf22bc84f83955d6cc0db650929c03a9187a52d98e6c47727bdfa42529c9e8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcf22bc84f83955d6cc0db650929c03a9187a52d98e6c47727bdfa42529c9e8b.dll,#1
  2⤵
  PID:788

memory/788-54-0x0000000000000000-mapping.dmp

Download
memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/788-56-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download