bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:49

Target

bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll
Size

5KB
MD5

5476f11b7b267b2912f7381e2c5f0600
SHA1

3d7c6c80541d548feab9c5ccdd043e1d7e209642
SHA256

bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6
SHA512

5512ac68175bfb6e02a387026400e8f223e3ffb5a78f390f649445867674966d975bb8bdce9eb93fe826145be66f113751d4d52042d615207d9db6a3beca8fa2
SSDEEP

96:nEY2RrF1eqwi4ZVLB4byU0aahII5yWZu7dbWz4:EHRh1eppjBoEII5yUAH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28
PID 560 wrote to memory of 1896	560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll,#1
  2⤵
  PID:1896

memory/1896-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download