00b4f6b28835a2b9ec195d70427fe6d010731d0644ffed65976934e71abf20fa

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:33

Target

00b4f6b28835a2b9ec195d70427fe6d010731d0644ffed65976934e71abf20fa.dll
Size

52KB
MD5

65dc0e74114e102c314569f9bca3945f
SHA1

0f58092b722f86c47f58c0dff865005464e733b3
SHA256

00b4f6b28835a2b9ec195d70427fe6d010731d0644ffed65976934e71abf20fa
SHA512

83bc53b633eda53d5d88a033d2983e4c8cf8d017048f19a524194086123a031b759ff5ab86dec6639325bc00ea4030fadfbc5d257695ac6b09b2e7bc84d9162e
SSDEEP

1536:wXx6VHfdv55m3dmXg/e8Y2JxzhWdDPUHN2qv6:IgVFv55m3Ew5YgGrU/6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b4f6b28835a2b9ec195d70427fe6d010731d0644ffed65976934e71abf20fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b4f6b28835a2b9ec195d70427fe6d010731d0644ffed65976934e71abf20fa.dll,#1
  2⤵
  PID:856

memory/856-54-0x0000000000000000-mapping.dmp

Download
memory/856-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download