ba5fbe406d69db1b0a0c1c77516fd57e67a864ca72af39a44c236e289c8c48ee

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:31

Target

ba5fbe406d69db1b0a0c1c77516fd57e67a864ca72af39a44c236e289c8c48ee.dll
Size

6KB
MD5

e1fc82dfc05371426b3a7390c86df2d0
SHA1

809724bfdfd931e94edff7c0fe381ff2c0d38b85
SHA256

ba5fbe406d69db1b0a0c1c77516fd57e67a864ca72af39a44c236e289c8c48ee
SHA512

1a734ac820d54600b4a1e2ceed11bd0a9b0bea2b4b6bd2afe3d38a0e56406757841a7283431904fb59e8dd8877a61257cca04f5fa52065bd26ba7673f1cb3644
SSDEEP

96:nEY2RrF1eqwi4NXuJDWjslwgll69zdtRX0wtK:EHRh1eppNIDWzJ95T

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5fbe406d69db1b0a0c1c77516fd57e67a864ca72af39a44c236e289c8c48ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5fbe406d69db1b0a0c1c77516fd57e67a864ca72af39a44c236e289c8c48ee.dll,#1
  2⤵
  PID:904

memory/904-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download