be2b60f2cc6c5411a48789b460180f07d0d8c133cb3d0767cf0133341fd5508e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 02:24

Target

be2b60f2cc6c5411a48789b460180f07d0d8c133cb3d0767cf0133341fd5508e.dll
Size

10KB
MD5

66aee165ec6484be6c26f8c641c86bb4
SHA1

d5a9e343f716008115cddd30abf58c99a94546e7
SHA256

be2b60f2cc6c5411a48789b460180f07d0d8c133cb3d0767cf0133341fd5508e
SHA512

9c2d6ff8a540299e20e35df5b6121ff224503336f08e78e5039945b2ee771c358b3fbd8d3f398a781b6ae5a18455de8d27141c2d6fa3b546b9167a5ff0a61a79
SSDEEP

192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o92b:48jhdHad/z20IyFWakC84dWaWak8cdWj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2b60f2cc6c5411a48789b460180f07d0d8c133cb3d0767cf0133341fd5508e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2b60f2cc6c5411a48789b460180f07d0d8c133cb3d0767cf0133341fd5508e.dll,#1
  2⤵
  PID:1456

memory/1456-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1456-56-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download