b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:23

Target

b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll
Size

53KB
MD5

5c37bc6c100c286f651deb83e85614a6
SHA1

d81891941ebbc775bd8bb4f389688a5c7a98d75c
SHA256

b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3
SHA512

fda6feca016ef7bdf8d6e345e9383da38da6286ab8af7a1d08a1a2e3726636eeb73ad356edb37098f078725e92a9b807f0d752746e0fa39ae58f44a912ba187b
SSDEEP

768:9xBtKtqyLUkw2+tbTaH8czdkJVw9TQb2X9oLi4bvXXR7ATWIdE5GIUiccfvDVqt9:96w262H8cJQm9LO1YGn00QPqg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27
PID 1172 wrote to memory of 900	1172	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll,#1
  2⤵
  PID:900

memory/900-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download