bfa757ba9d3a8229ee926be2389ce05766a3cdeffffcb3d9f79f955e2a4114bb

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 21:19

Target

bfa757ba9d3a8229ee926be2389ce05766a3cdeffffcb3d9f79f955e2a4114bb.dll
Size

48KB
MD5

fbe9f6fdeb6c1a892f1b0d0c797bd5a5
SHA1

ab1a2de0cd44fe769dd68d14c4c6e44b8a0b09c8
SHA256

bfa757ba9d3a8229ee926be2389ce05766a3cdeffffcb3d9f79f955e2a4114bb
SHA512

199b1096ea6ca8a18f7e695b5b5669c54572b400811c00e840623a1775cafa1d2fa0a2b2993be6c69323d792db73683dbb22851f53f0720bd2eb0ac88417f06b
SSDEEP

768:0edOExWuY7LzDwNHY5W2QyaU7rFDMBYRY55iqhk2bStZylj/UweB5IGPE3wr7ys:0sW3HD9JrfWTj/dd3Ays

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28
PID 968 wrote to memory of 1492	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa757ba9d3a8229ee926be2389ce05766a3cdeffffcb3d9f79f955e2a4114bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa757ba9d3a8229ee926be2389ce05766a3cdeffffcb3d9f79f955e2a4114bb.dll,#1
  2⤵
  PID:1492

memory/1492-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download