bfb64b8d90f5a104458f4cd4d56f4c1036a41f6747d25007b645bc32642d7f17

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:28

Target

bfb64b8d90f5a104458f4cd4d56f4c1036a41f6747d25007b645bc32642d7f17.dll
Size

70KB
MD5

8da1744d6285ecea0131d21c5f37f8ab
SHA1

31784e0f13d5b0c916c91a31e990ace7114b6695
SHA256

bfb64b8d90f5a104458f4cd4d56f4c1036a41f6747d25007b645bc32642d7f17
SHA512

ea48557000370ded9f01be3635b0feebe453a2c70c8e921b027ea6e7fa5e658c1f8a56a996de408b9de2bf7bc6ef72176889d0743960e143e028707288589dcd
SSDEEP

1536:1naK1hVqllqKFUanDHTO79Unu1F8CT8L/ST0gF2uVIqb6Nsqho7Dq:1naK1hECKianzyUqNT8rSxMuHawq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18
PID 1720 wrote to memory of 1300	1720	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb64b8d90f5a104458f4cd4d56f4c1036a41f6747d25007b645bc32642d7f17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb64b8d90f5a104458f4cd4d56f4c1036a41f6747d25007b645bc32642d7f17.dll,#1
  2⤵
  PID:1300

memory/1300-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1300-56-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download