bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 07:00

Target

bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll
Size

19KB
MD5

6905617a2d3d8aba1c41339fdae54e00
SHA1

31b762c1607356ae933bf3b862cbfa180427437f
SHA256

bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b
SHA512

7a08f0e047abec120b8c32ab05bff6bee53e60ee1c7409342c723cdfd844350750884d9f6c48eaf461da0e4d08111ae381b154db299d08e9f609e1484e3e564d
SSDEEP

384:C5vbsBZn2xaXmVFW6/DlmIJOEd0X1fdCGWH8B7Wo00P0r:C5ABZn2xEmLj/3dXEBT0Ws

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll,#1
  2⤵
  PID:1080

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download