bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:52

Target

bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll
Size

268KB
MD5

733b2312191a7feffb243c2f8fb58057
SHA1

d1537bb80ad143205f8abc6d4446fecaa0e5e488
SHA256

bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63
SHA512

6bf2b3585626d632698816eb9232c97d2c57923dfa631ec111072b6eba51912e94a0934fe18f51bd46f92dae4daf107767579ae0dbd7b18b9f0403cd5162373d
SSDEEP

3072:XXWoz1Ah0c2KUbHCEUqfZdVBNbsjCqAJq257VoNyTCCm2lMPZqH0:XXWozQ07HBfCC1MPZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll,#1
  2⤵
  PID:840

memory/840-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/840-56-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download