b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7

Analysis

max time kernel
42s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:45

Target

b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll
Size

5KB
MD5

610fae4df9197f66f33212846a1b157b
SHA1

1540c403072d9f9e88b0a5651e6159610b91fbde
SHA256

b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7
SHA512

136d37e4cd6cbb543f10141fcf545597cb1d22bb34ca669385925afd4bf74fc8876ff7edb0ae48e0f32932c0f4194852dfe9415d5db38e41d8510f5dc1e4a085
SSDEEP

96:nEY2RrF1eqwi4qnFS0MIF6h2oxGlwSnTB68YFjX:EHRh1epp0FSP2oxGlwMB6pFr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download