0bd329047c84466fb9197ddb1715fa8ca1ac077b8fdd947be2234cdf88d4ce0b

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:12

Target

0bd329047c84466fb9197ddb1715fa8ca1ac077b8fdd947be2234cdf88d4ce0b.dll
Size

5KB
MD5

5579f6ef645391001458cc4f45a53310
SHA1

3bd606e181a30a7e718868614323115a3690a972
SHA256

0bd329047c84466fb9197ddb1715fa8ca1ac077b8fdd947be2234cdf88d4ce0b
SHA512

9ff1b32de7f334074a77d9d5be568d2f1f31562292a6873990ee0cbbdec311a6149b7ed83d789950ae96f70ce56fce4674001545d0db0587dafc15fdb94179ae
SSDEEP

96:nI2RrUeqL0Xq0d3T6pyh6B03caqznkePoW:XR4eXT6kjGznke

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28
PID 1976 wrote to memory of 1988	1976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd329047c84466fb9197ddb1715fa8ca1ac077b8fdd947be2234cdf88d4ce0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd329047c84466fb9197ddb1715fa8ca1ac077b8fdd947be2234cdf88d4ce0b.dll,#1
  2⤵
  PID:1988

memory/1988-54-0x0000000000000000-mapping.dmp

Download
memory/1988-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download