b84b7922b6a4b6f6140bcad7312a754e45e84ec868484509934d8e3222702b6f

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 20:05

Target

b84b7922b6a4b6f6140bcad7312a754e45e84ec868484509934d8e3222702b6f.dll
Size

278KB
MD5

2b6ce782adc5079849b5558dd23309d8
SHA1

2a65183254e7f4d76673075f4eada3c7af93e5e5
SHA256

b84b7922b6a4b6f6140bcad7312a754e45e84ec868484509934d8e3222702b6f
SHA512

bc36dbfcba72d50be9d4fb269178cac38bf7088e0d8815d1c092573782c7a83f08a5ef3011e83f09ef635eec968ca8485e3b7c49eb4ef490924df714143006b4
SSDEEP

6144:10In8PFfhAERaCohXZ9uFgmv0rSb1RX5M1dDcXMPVjVucw3YKBU:10InWFFRwh/uGmvBb1d4dAXuYB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b84b7922b6a4b6f6140bcad7312a754e45e84ec868484509934d8e3222702b6f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b84b7922b6a4b6f6140bcad7312a754e45e84ec868484509934d8e3222702b6f.dll,#1
  2⤵
  PID:1176

memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1176-56-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download