bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 04:49

Target

bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll
Size

160KB
MD5

64a59953a750b94e7daee2e6128215c6
SHA1

9d015e88ddc621243277b78809b551527638378a
SHA256

bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999
SHA512

994917d310ea456bff46fb4bd5016d3831943dbd446121a97b9cb93d853a1e250bb9484d575f50763ac5f80d1bffa06748bb080f1c223fea0cc206ea90ebaa17
SSDEEP

3072:+NA8wH3QSLR+IxSbAc3gklQKS2zVWgoOpm:8A8oAAnSbAcnCKJHogm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26
PID 2032 wrote to memory of 1128	2032	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll,#1
  2⤵
  PID:1128

memory/1128-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000061B10000-0x0000000061B3A000-memory.dmp

Filesize
168KB

Download
memory/1128-57-0x0000000061B10000-0x0000000061B3A000-memory.dmp

Filesize
168KB

Download
memory/1128-58-0x0000000061B10000-0x0000000061B3A000-memory.dmp

Filesize
168KB

Download