bd97fb37b04ea2c9facf56fc048691391e6801f6d33990f8b4888d74d9fd6d42

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:43

Target

bd97fb37b04ea2c9facf56fc048691391e6801f6d33990f8b4888d74d9fd6d42.dll
Size

199KB
MD5

35fdee0730675d9e38d715e2f3f2c66f
SHA1

31fb4a2cb681cf5b473c9fdd10f4c2a7843073ca
SHA256

bd97fb37b04ea2c9facf56fc048691391e6801f6d33990f8b4888d74d9fd6d42
SHA512

02b3753ac3f93d595dc8b3a0e24a6e030e828e52272a5145727ecfc5f77f94b6b3d4d7e7d7082021fa1b9798dab06791047f9928b26760c3495d90166e6d1dd9
SSDEEP

3072:2+mKvHI3k4HTlDNeVtvnYjJVNJXcpZxEDPMFaGtyHZ:2+Jo3k4JDNeVtvnKMCPLGty

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28
PID 1952 wrote to memory of 668	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd97fb37b04ea2c9facf56fc048691391e6801f6d33990f8b4888d74d9fd6d42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd97fb37b04ea2c9facf56fc048691391e6801f6d33990f8b4888d74d9fd6d42.dll,#1
  2⤵
  PID:668

memory/668-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/668-56-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download