1ba1cace5ab9f21670c87c987c9f8bc6b5c9b2a16e0cbce57da915483a818770

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:33

Target

1ba1cace5ab9f21670c87c987c9f8bc6b5c9b2a16e0cbce57da915483a818770.dll
Size

4KB
MD5

683444a73ac6ad96ca7227c2a53cda50
SHA1

2aa60c35d57de6e3e3fca87f465ee1c46ad7870d
SHA256

1ba1cace5ab9f21670c87c987c9f8bc6b5c9b2a16e0cbce57da915483a818770
SHA512

498753cbcec1a9983ed6f9c81f0644139fad4122290482cf256b88562e170a250224eb814fbacab8da562c92c53bc93c36b8e6514c37aeb158161e75b8461001
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mmXTgpsr1h:PmkiIz8UZrQ0MhI/ITqlyXT+kh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba1cace5ab9f21670c87c987c9f8bc6b5c9b2a16e0cbce57da915483a818770.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba1cace5ab9f21670c87c987c9f8bc6b5c9b2a16e0cbce57da915483a818770.dll,#1
  2⤵
  PID:1220

memory/1220-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download