b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 05:17

Target

b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll
Size

24KB
MD5

7aba811395e805849022ddf46c555d41
SHA1

bf161b8cf64b857c66d3991e91732fa2c8c3997f
SHA256

b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362
SHA512

b00f02e81123fff51f40e52503acc69698fd7c065dc91d1ef89e6fed36ae782caf42bff484b2c35574bb083a078ee6a3a3747d3b3dc51a472f3abcaa702e6226
SSDEEP

192:fsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXky:fcG8W59LhtEQA/4O82FV9PS8Vkwky

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26
PID 1564 wrote to memory of 1216	1564	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll,#1
  2⤵
  PID:1216

memory/1216-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download