bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 04:55

Target

bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll
Size

1.0MB
MD5

0a4f73d54adbcc94b96a17d6914675b0
SHA1

b2f7a93b05b8dd2a2358b475adf5ebfde6cc81d6
SHA256

bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80
SHA512

46e698422d24b6264652961f4ea381c753e3f983445fe5d428c4667f05d5949fb5b18432319346bf3aedfa25c09109c18e0e59ddbb31ea17166ce6494f65519d
SSDEEP

1536:tOGC0lvO/1jNOTyoIUqf6E1sFwXb+Pf6btKNn:tRCoCNCPYXb+qbtK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28
PID 1468 wrote to memory of 1268	1468	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll,#1
  2⤵
  PID:1268

memory/1268-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download