b43fb504e338486db985e8889a7ec826e257ef09bbab5b3d00f632a5d9c3b098

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 19:09

Target

b43fb504e338486db985e8889a7ec826e257ef09bbab5b3d00f632a5d9c3b098.dll
Size

32KB
MD5

c6620d81cfabafd7a4013c3088c4e7fb
SHA1

be6980d02baa1b90b64f7cd7e99d453240ec9ae7
SHA256

b43fb504e338486db985e8889a7ec826e257ef09bbab5b3d00f632a5d9c3b098
SHA512

b091a3dee13b892c5fee801070a1f10f5a876f20a989ff10bf2afababb34dc4c71f82fd5aa779d41f2c3d639cbc27a954a41d4c9c475f02eb961c13e80e14bdc
SSDEEP

768:mN/CMPCo5t+dOpk7Vz7LPT1IShVD8R963Ad:mN/CMPCA4Oe57LrXHARIi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b43fb504e338486db985e8889a7ec826e257ef09bbab5b3d00f632a5d9c3b098.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b43fb504e338486db985e8889a7ec826e257ef09bbab5b3d00f632a5d9c3b098.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download