b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:00

Target

b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll
Size

4KB
MD5

94492a08de4db94e802340f0ce3be3e0
SHA1

17334177a18e39d6edbe1e74fe9cf7819e7b0ea1
SHA256

b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec
SHA512

63314d60821f3f3f433b86d7aebb7f1de68e58c2de00bbc311f66a82168cc33583a85583003d495918009872975b9395b12898cd72f349a60fa98c65650841cb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LH9gLnki82wHSyibw65C2DRrlv3Sb/TWz:TRphMzf8qT2RSyi8gC2lZO/KmQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28
PID 1788 wrote to memory of 2040	1788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll,#1
  2⤵
  PID:2040

memory/2040-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download