bb0926325b1ad114bbe35ca4f800b03c74c003c3d13a2d9252c2709368486b7a

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 23:08

Target

bb0926325b1ad114bbe35ca4f800b03c74c003c3d13a2d9252c2709368486b7a.dll
Size

95KB
MD5

0b1d5247b29f8c8ec6586bce9b75a73a
SHA1

60dbb7d7d7aabab5bab322bd3c189eeb55a4e03c
SHA256

bb0926325b1ad114bbe35ca4f800b03c74c003c3d13a2d9252c2709368486b7a
SHA512

cbb365dc46aab1b31066cef60cff73bc536323fb71ba7128b90af73effa3a5549e85e57e8205db9df9ec639adcffd3670352327e2048b0f310a90de5b52f28c4
SSDEEP

48:iJmykKP7dFcXBzbonRQJh5qmit1ONKjLIK14LSmmfZtokc0XyKA+SJHNo:6znQB4nqqr1O08mmnuhJSg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0926325b1ad114bbe35ca4f800b03c74c003c3d13a2d9252c2709368486b7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0926325b1ad114bbe35ca4f800b03c74c003c3d13a2d9252c2709368486b7a.dll,#1
  2⤵
  PID:1172

memory/1172-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download