b7a8032921d5bce7d4a986cb3de769eb183f51c7d2186f36860ba7c059d063d0

Analysis

max time kernel
229s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:34

Target

b7a8032921d5bce7d4a986cb3de769eb183f51c7d2186f36860ba7c059d063d0.dll
Size

58KB
MD5

399b648085e2d4b83a22f66e9ffdf0fc
SHA1

a9a72905c88ec1a4c604deb9b006a77ed53d121a
SHA256

b7a8032921d5bce7d4a986cb3de769eb183f51c7d2186f36860ba7c059d063d0
SHA512

b3a6fb745bc9958e3b14d20c2c698a23844eff1d38e6294ff60ad54a0d0fec9c7709af09a669e76854bc4b2b6f846979e73fb8754f9a98900644da5af466ee98
SSDEEP

1536:V8O9Nn6RjriMBZKQglKzLRnXHLpGPBkL8rqUY53:2Oz6VW6ZKQ+sL5HLpaOLeqUC3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27
PID 772 wrote to memory of 780	772	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a8032921d5bce7d4a986cb3de769eb183f51c7d2186f36860ba7c059d063d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a8032921d5bce7d4a986cb3de769eb183f51c7d2186f36860ba7c059d063d0.dll,#1
  2⤵
  PID:780

memory/780-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download