bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:27

Target

bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll
Size

111KB
MD5

178e7887eefaec27a588eac5a10bdbde
SHA1

db39955fde683f81077195cd984bc15282df5691
SHA256

bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b
SHA512

c49e85d9068a71725a9601d593c1b68e5b274837b32c4bfd0e0593447bf671e24d94492a2e53c7d379bb7f49f1c1bd1d1095c4cbcc4f6359ccdabe59cc82cd55
SSDEEP

3072:7CpATw+0P+FNR0LUGUwzNVTeOgfom8M3IvjO:2pATlF3TMz2Ogfomz0O

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27
PID 1208 wrote to memory of 1620	1208	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll,#1
  2⤵
  PID:1620

memory/1620-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1620-56-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1620-57-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/1620-58-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download