b255b423d48335ff1dd1f1d84f725f387fd920b19925dd03ce991ca9f6f0384e

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 01:12

Target

b255b423d48335ff1dd1f1d84f725f387fd920b19925dd03ce991ca9f6f0384e.dll
Size

10KB
MD5

6d5967b50761378f482f4e0126be21e4
SHA1

3983347f55fe6eaaf2a48586eb9bf67124179a16
SHA256

b255b423d48335ff1dd1f1d84f725f387fd920b19925dd03ce991ca9f6f0384e
SHA512

624a6af60a903dcbf0f2e39800ecf739fb5c51272303cc53d81c3131b6de04dfcb2b59a0fd3bd111d8a86a44ec41102e6cec6e18fecd021ba40634f3d7f0940b
SSDEEP

192:dnopbFLWfrLGCyFo195MQzZrDIBHb+mtS2zHvwp7D+97L1472rqpucXuhFXMFDTe:gcGC15MQa7ptrzHvU7Dg/14arqp+F8Fe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b255b423d48335ff1dd1f1d84f725f387fd920b19925dd03ce991ca9f6f0384e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b255b423d48335ff1dd1f1d84f725f387fd920b19925dd03ce991ca9f6f0384e.dll,#1
  2⤵
  PID:896

memory/896-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x0000000010000000-0x00000000116F4000-memory.dmp

Filesize
23.0MB

Download
memory/896-57-0x0000000010000000-0x00000000116F4000-memory.dmp

Filesize
23.0MB

Download