ff1ba495e9a524a4d72c5719bc31b34a8beb7de7b0033e8cf1fcb186d79b23a4

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:28

Target

ff1ba495e9a524a4d72c5719bc31b34a8beb7de7b0033e8cf1fcb186d79b23a4.dll
Size

149KB
MD5

40fe3a502bbc0f3a4b8559507c3f8392
SHA1

5a71fee34ca495b7cbb324724cdba594dcfb19c6
SHA256

ff1ba495e9a524a4d72c5719bc31b34a8beb7de7b0033e8cf1fcb186d79b23a4
SHA512

aaf9f219fb34ec5266bd75629778611d33a36f1c1695134ced3c5d9d49dd96afdff1a7a11ed510f799d09dfe5dd86ce0c51c052c8ed587db4f26b539ce4207d4
SSDEEP

1536:S8IcUIlIjkuvfZ/AuwqBQDaOHCg6naXe26RU52HVZVLAMya:hOy8xvfGqibP6nVRb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff1ba495e9a524a4d72c5719bc31b34a8beb7de7b0033e8cf1fcb186d79b23a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff1ba495e9a524a4d72c5719bc31b34a8beb7de7b0033e8cf1fcb186d79b23a4.dll,#1
  2⤵
  PID:1204

memory/1204-54-0x0000000000000000-mapping.dmp

Download
memory/1204-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download