b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d

Analysis

max time kernel
18s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 19:19

Target

b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll
Size

538KB
MD5

6236343c35d0c4c571934cfc80bde8cc
SHA1

46a1d7d15ea535d1bb58acb020c253a465f303b7
SHA256

b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d
SHA512

1f36bbd05c92881f01e4476b35dc2b53601d2c85475819448424931b87d5b6b483f192df8954a4fdc4a830d4d7e82b45dde880f7d1fdd7a3b9ec12158a7fa696
SSDEEP

6144:I4bvBxVzGaywrXtgpIjYAiGBnCP9OUAt/b77:zB5ywrXALLGAPE3/H7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27
PID 1800 wrote to memory of 1368	1800	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll,#1
  2⤵
  PID:1368

memory/1368-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download