b71a60b8d4730a3fffd9d3208fab5fe36957aaf7ea3cc37a7e00eacd0ea59b7d

Analysis

max time kernel
11s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:46

Target

b71a60b8d4730a3fffd9d3208fab5fe36957aaf7ea3cc37a7e00eacd0ea59b7d.dll
Size

33KB
MD5

f7b8e765bb402d266208dcee90078e01
SHA1

afd553f2f7524199dad50f98fecb9c6913fb9015
SHA256

b71a60b8d4730a3fffd9d3208fab5fe36957aaf7ea3cc37a7e00eacd0ea59b7d
SHA512

720b70d5fbbbfb6d19afe4f53567df6f0df38698e4d3b51875666625859e9de059b7703a86847115714f8c98a36863236d34ee5fab492ef7d01113a12c0bc769
SSDEEP

384:6HPdWg8UrMRErP6fgn9dLwTY+wiF5SQODW6PHqNV0qIqCWt9N0swmPTz5ogg5wrX:6vEg8R26edLwUOmHnWCw9N8dOnX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28
PID 1452 wrote to memory of 1884	1452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b71a60b8d4730a3fffd9d3208fab5fe36957aaf7ea3cc37a7e00eacd0ea59b7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b71a60b8d4730a3fffd9d3208fab5fe36957aaf7ea3cc37a7e00eacd0ea59b7d.dll,#1
  2⤵
  PID:1884

memory/1884-54-0x0000000000000000-mapping.dmp

Download
memory/1884-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download