ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19

Analysis

max time kernel
15s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 10:52

Target

ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll
Size

363KB
MD5

0da87308be82a1ff563735a689dc5ea0
SHA1

5b0d07d6808574e1f5893e282d05fcaf34c88cd4
SHA256

ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19
SHA512

b5a703c28f74fc094524e440e109a2a5d11dd4691865c1edc955ddc3e9cf39b5be76b1e34cadee2aa81240350e7c27e6da0547f1e82d8966653eeec221b7c901
SSDEEP

6144:0qPkHbjSrvGh1Jvfz45O7IBDjpT4F2v6nw1VFbdC3e3l5K0xcUrIs/xl+TytMEiC:0qPkHPiOf2pUYCnwnFbBl5nxbkSEwOIX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28
PID 1980 wrote to memory of 1968	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download