bbe881939787c82954288febd675bd7f804a82b12a3ba46137dd74ef94823bd4

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 06:27

Target

bbe881939787c82954288febd675bd7f804a82b12a3ba46137dd74ef94823bd4.dll
Size

56KB
MD5

81305ffcaa3e145909fc47ab14e653cb
SHA1

cb699530219bc1a76988b3d5a05bcdd177305311
SHA256

bbe881939787c82954288febd675bd7f804a82b12a3ba46137dd74ef94823bd4
SHA512

66ef9e83f8d0a358d91f74cc5a74fc2e19930498b11e100d946471e15fff60863f4d044d0958ee036390665ef5c0dfaae28a62f7929b4ebb33df42177224994c
SSDEEP

1536:mPO6KEVbsVP0gsLo/tG374m/1eCfET2CkPFA:cMEVbsVc3s/ta8m/1hfHNA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe881939787c82954288febd675bd7f804a82b12a3ba46137dd74ef94823bd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe881939787c82954288febd675bd7f804a82b12a3ba46137dd74ef94823bd4.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download