923793b5ebd17ef82d44d152c1f34b0010f366a8ee84a41d86dd7ad4ecf6e153

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/09/2022, 06:49

Target

wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.22621.1_none_7e1bef6b3f293f16_bcryptprimitives.dll
Size

389KB
MD5

89773b4c49849b526e59c958f9c03bb2
SHA1

2bddf49a72622800dcad7e5dbba100198b52280e
SHA256

e9817ab05123e1596b395569b95f6efe303dbba35a1f1232160c7b8bc18be616
SHA512

c9b82e4fd1609eadf13dc1286818b88ac8d62c8d57d03d29e150bca67b5420090fc5664073e6bd406acb54fce640af3303ee07cfea863ac914c7511aa185ea95
SSDEEP

6144:rCxGooolqqDX5m4rnGoB/pA5EM18g+FKvWS4jEKEXcHihlv6wKepP:1oIqT7596ENg+FKvgjEX6ihlvOet

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.22621.1_none_7e1bef6b3f293f16_bcryptprimitives.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.22621.1_none_7e1bef6b3f293f16_bcryptprimitives.dll,#1
  2⤵
  PID:1536

memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download