b83320b56db66f31defe747fc6473915201e723b0ba3051fa9c537a11cee5e95

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 04:30

Target

b83320b56db66f31defe747fc6473915201e723b0ba3051fa9c537a11cee5e95.dll
Size

84KB
MD5

4849075fce6ce845c1f35b4fa556d387
SHA1

0c94bd8c6257f7b647b37c90e52e74498cfc2105
SHA256

b83320b56db66f31defe747fc6473915201e723b0ba3051fa9c537a11cee5e95
SHA512

1f165ae47dcca225c32670dfe50645430b7035c5ec549d80a20ebe7966f5425c27295889c5eea87f7e43b7bb5ca71b7a616065f9fea3042d304792bbc21dbd83
SSDEEP

1536:Nh1fL15Vx2G5bCgsSeyhx7tfmwgTW1+44IlR1wlm8wUFKcP/+:Nh53p5NIyhxp+0DLfwlm89FKcH+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27
PID 1880 wrote to memory of 1092	1880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83320b56db66f31defe747fc6473915201e723b0ba3051fa9c537a11cee5e95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83320b56db66f31defe747fc6473915201e723b0ba3051fa9c537a11cee5e95.dll,#1
  2⤵
  PID:1092

memory/1092-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download