b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:57

Target

b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll
Size

18KB
MD5

bb991ec29a6e275e2a30f8308bd00ce4
SHA1

39171b62a2552203f52759ffc9004fad7b4ea84c
SHA256

b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b
SHA512

0160b5efe1adced898b811d32fdf19cc87576dcd011e61fda87d6688ac6692c56ed57d452274a04e1a9a8d065645a3fb2a545409059ed1aef1e0f5a0818fb42d
SSDEEP

384:EiBHo7xX9iGgOa7Pfp+/BRiBZWG5VL3ArCQBY+B7TUXiaPO7DfkKD:EP7TiGgH7PR8BnKVL3T+B7gXXPwkm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#1
  2⤵
  PID:1032

memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download