bfc510509a95408804e8b0f67c1a916d262fa0d1b1502d2d9697f1b30f9ebe3f

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:25

Target

bfc510509a95408804e8b0f67c1a916d262fa0d1b1502d2d9697f1b30f9ebe3f.dll
Size

87KB
MD5

7a4f874ff0181ec506b32fc1eb9dea10
SHA1

40f20152696a61fdeccfd8a1a19c9eaf9ec6cea8
SHA256

bfc510509a95408804e8b0f67c1a916d262fa0d1b1502d2d9697f1b30f9ebe3f
SHA512

e6e5614701205b26573b7ac5308ac023d2895ae07bd5396cd339c1ed26c20ab0c86f62e7cba56f0dac8e372cc3f341b6f29099c0b2f0821ae1bdcb705af86c6a
SSDEEP

1536:FQStMbXdR8HcqSez9qF3XLXBTCP0hfQ9Jcs96VDTVUS:FQNj388Lv02fe6VvT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfc510509a95408804e8b0f67c1a916d262fa0d1b1502d2d9697f1b30f9ebe3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfc510509a95408804e8b0f67c1a916d262fa0d1b1502d2d9697f1b30f9ebe3f.dll,#1
  2⤵
  PID:1952

memory/1952-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download