b48096ad223a70949dbfd2054e61564d37bba5a2884205364d5403cc5427bb71

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:49

Target

b48096ad223a70949dbfd2054e61564d37bba5a2884205364d5403cc5427bb71.dll
Size

5KB
MD5

bbda25f06571472a0e8a8f347ed120e0
SHA1

196aad62ffbeaad75ff6a1a73ffc3dc3e4a153ee
SHA256

b48096ad223a70949dbfd2054e61564d37bba5a2884205364d5403cc5427bb71
SHA512

df79d82c296145d966b9287cfad194341b211b57532dba668fa0a21878a03930217b0d848befb2abc013d63402c8cda430bb4785c607fd5c08caabd6878e3ed6
SSDEEP

96:nEY2RrF1eqwi4l8WyuB+qdtB7MvnPczQts:EHRh1epplDldr7JQt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b48096ad223a70949dbfd2054e61564d37bba5a2884205364d5403cc5427bb71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b48096ad223a70949dbfd2054e61564d37bba5a2884205364d5403cc5427bb71.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download