ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 18:34

Target

ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll
Size

5KB
MD5

074441de2ca21471ace199a60c0eeeaa
SHA1

e76c68595d0ce814e94533784fd2c486a407f87e
SHA256

ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955
SHA512

f6371d38745d736ffb08c1921210c260e10ad20149ee9dec66a48769671820d69246b1697767ef5a2b8132a3c9bd4376db1eb1de2623484e6b06caa4d78a293a
SSDEEP

96:qT+ZKXI71G6Ezj1fzVbMIsv28nM5Y14pmWH1:qKkaGnxVbMIWnD14pnH1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download