ba61aaec82555c9a7224e8757b53134c98fc62ccae5c8a9ac0e90eef7b7c18f2

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:59

Target

ba61aaec82555c9a7224e8757b53134c98fc62ccae5c8a9ac0e90eef7b7c18f2.dll
Size

32KB
MD5

0580ec5a9221e7e27258c6cc63e0b6c5
SHA1

c72de9191b764dc82b224778eead5b8d85e91b43
SHA256

ba61aaec82555c9a7224e8757b53134c98fc62ccae5c8a9ac0e90eef7b7c18f2
SHA512

cc260c02de728c8c9969e836da6543572e15bb5cf12ac10d9918eba49d0a97854f818cc73c2d7bf847a9ab8d186f5ea1f9dc91665ecb2d58b4e8b97970c52274
SSDEEP

768:+MhqpHLSlNb31pbNG7v6fbZOVOQKTRqMuBkK:TqpA1pQ7ifbK2RqMuBd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba61aaec82555c9a7224e8757b53134c98fc62ccae5c8a9ac0e90eef7b7c18f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba61aaec82555c9a7224e8757b53134c98fc62ccae5c8a9ac0e90eef7b7c18f2.dll,#1
  2⤵
  PID:1568

memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download