8b0dcfa8a9eb89723a691283787c2508e62585f640eb3733da014e12a3c4bbcb

Analysis

max time kernel
16s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:44

Target

8b0dcfa8a9eb89723a691283787c2508e62585f640eb3733da014e12a3c4bbcb.dll
Size

4KB
MD5

0fb02c75f7b6f392e2b82e5fedaa8780
SHA1

9ec2e1f45e450943f83a13f45bc6f38d1035a801
SHA256

8b0dcfa8a9eb89723a691283787c2508e62585f640eb3733da014e12a3c4bbcb
SHA512

ab4dd19dd8b296c7be41272102b9ccf4ea88815fe00387cc5b0320f72c1663bfd12b344dd1b7fb5b6a4ae128917f51ad6b2bdddb3d077cb31e166d47b90e48fe
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9BMA8GDd:PmkiIz8UZrQ0MhI/ITqly9BM2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b0dcfa8a9eb89723a691283787c2508e62585f640eb3733da014e12a3c4bbcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b0dcfa8a9eb89723a691283787c2508e62585f640eb3733da014e12a3c4bbcb.dll,#1
  2⤵
  PID:972

memory/972-54-0x0000000000000000-mapping.dmp

Download
memory/972-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download