fb8d75958dba894e82d151a64cf9e0acb85b1c802a643716d5a7340b5679a51b

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:45

Target

fb8d75958dba894e82d151a64cf9e0acb85b1c802a643716d5a7340b5679a51b.dll
Size

972KB
MD5

07dcbebd6995cd5b3101fb42870b7a9c
SHA1

3113e525be42aefdff813ae8ce703bb8b5f950ae
SHA256

fb8d75958dba894e82d151a64cf9e0acb85b1c802a643716d5a7340b5679a51b
SHA512

abfc1f414677971dd037f0029a146d275d58af0c534dbfab7c52a1f2795a0961e78cc3ed4083153d7855275755ed90a178af68f372b3ccaa49c38bb0301e30f3
SSDEEP

12288:bXKtl3NHhwXMGBfIXRkSSFbKKQKBmQNN3t7X:gR5iXzgXREFbRBmSN31

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8d75958dba894e82d151a64cf9e0acb85b1c802a643716d5a7340b5679a51b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8d75958dba894e82d151a64cf9e0acb85b1c802a643716d5a7340b5679a51b.dll,#1
  2⤵
  PID:1528

memory/1528-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download