bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:06

Target

bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll
Size

171KB
MD5

e59e9a85ba7fe3f48cead1ca0d980e7a
SHA1

c4c341d307830b88348fb519bbebd4c8825d8820
SHA256

bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477
SHA512

0e14ec61f4b25c130419c35cb7b7b937e4b908805868cf643166feca22057eaaca7f25339347456ed50fab24335e0c35092ee23fdbd227ff83bd6816fbb634dc
SSDEEP

3072:8vp4shD1jhlqUpPMMVS4eKuM1fxyqKSsbwl2/sQbvg+1aBPMzJOq:8/hD1hlqUpP1tPt2SzSFboskMzJO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll,#1
  2⤵
  PID:1388

memory/1388-54-0x0000000000000000-mapping.dmp

Download
memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download
memory/1388-57-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download