1bf988cb9f919b495ebece8aa9439c03e2cfb1ad42031abe948bd1c219e44147

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 19:48

Target

1bf988cb9f919b495ebece8aa9439c03e2cfb1ad42031abe948bd1c219e44147.dll
Size

231KB
MD5

6b9dde0d221c1b975db3a1adb974485f
SHA1

51a1bbc84f6c451cb2fe3fa7e43d7825907a0d5b
SHA256

1bf988cb9f919b495ebece8aa9439c03e2cfb1ad42031abe948bd1c219e44147
SHA512

d052f29b3744e1ea453f4459e9b5f3b9bbe55ffe0999dc9077e84562b6d04bf0ed22d7364c1621f9468e830a600963c2c4047e60964467bfa0abca7180e38570
SSDEEP

6144:NHtsZ06e2AkJ3MnPxYHKxo5pd2TzmWAjHiQtSD26+OOj6eb:NHGZ06e2AG3GPxYHF52TCWA/EA1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27
PID 1324 wrote to memory of 1352	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bf988cb9f919b495ebece8aa9439c03e2cfb1ad42031abe948bd1c219e44147.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bf988cb9f919b495ebece8aa9439c03e2cfb1ad42031abe948bd1c219e44147.dll,#1
  2⤵
  PID:1352

memory/1352-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1352-56-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download