b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-10-2022 01:35

Target

b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll
Size

401KB
MD5

54aec528621286ab0e62f02d08f8d911
SHA1

02e463479c07b889f5f88605b174cff0ebffebc2
SHA256

b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b
SHA512

763e95c2d349225e6465f86d858d17d0222a56ee1b5c12c8e405b7670dadc59ae40328558bfc6a6aec10cc1fcc372fa2874e325dc1c38783194b22cdb798d2eb
SSDEEP

6144:AGpUsW+mjJfO0b+VMeZJUlR9wxTDS3nrmm8fxVG8iTzE:B7T0MZgCs8a8eE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27
PID 1672 wrote to memory of 1644	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll,#1
  2⤵
  PID:1644

memory/1644-54-0x0000000000000000-mapping.dmp

Download
memory/1644-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download