bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 15:53

Target

bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll
Size

6KB
MD5

0d3b8c98dd19c197c5c8ab6c40a23260
SHA1

b67db530ee59cc6c41d1d53d06e6267810e2d44c
SHA256

bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720
SHA512

748ea7d4cb185cad3f753e0cc78f19b26d3f046e0f32cb7e843f629ad4fe861675d6cfdf6b7bc12a02c8526868ea4d032363bbf7380e87f38c9722c9f65ef411
SSDEEP

96:z0/gPtJrYmVjGwd+8blPDDDDDDDDEZSIs23AteE1SjuS8x:FTiS+siZQ23AteEkjuS8x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27
PID 1396 wrote to memory of 952	1396	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll,#1
  2⤵
  PID:952

memory/952-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download