b35c16f01dc4e99ef426d0c07d5b8eec5ff0daba3819a954aa227d58d866958d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 07:44

Target

b35c16f01dc4e99ef426d0c07d5b8eec5ff0daba3819a954aa227d58d866958d.dll
Size

82KB
MD5

93336ea4db437dccd003f5de61c98202
SHA1

b7f37df5504b5831674dff29b81cdf4ff9f886fd
SHA256

b35c16f01dc4e99ef426d0c07d5b8eec5ff0daba3819a954aa227d58d866958d
SHA512

8bfd1e841d417d8c340abc9eaefbc850ce26d862f6fcd736bec160e8199505400233d7372ac06c9124befff2c59eb730f89c3c2ca5fc78248afbfd7d2fa16cb8
SSDEEP

1536:Xrj2DTisS3kalQmG/iwErqofw/NeHnHacQp5:v2DTv1alQRE2SHa1p5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35c16f01dc4e99ef426d0c07d5b8eec5ff0daba3819a954aa227d58d866958d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35c16f01dc4e99ef426d0c07d5b8eec5ff0daba3819a954aa227d58d866958d.dll,#1
  2⤵
  PID:1124

memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download