b02bf9dcd11729c483de1adbf36e5ee00e33c13b756744cb290306749ae87632

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:35

Target

b02bf9dcd11729c483de1adbf36e5ee00e33c13b756744cb290306749ae87632.dll
Size

59KB
MD5

f5fe1b3d37c4e94ceee101cea2046ac0
SHA1

b83595e58eff99e0f24e8b7d75dafbeedc51d3cd
SHA256

b02bf9dcd11729c483de1adbf36e5ee00e33c13b756744cb290306749ae87632
SHA512

3d1628aca1c4dc1f6a5fa217a0017c5b0c06940ae1d4890ba93b08fc2283f43713213f41f5736571e701815c478071185fff3b42a4066109951e6c0da969d59a
SSDEEP

1536:RVs2sMT4jDXaX4+DuCR6IAC/dQT5fnS+TYi7ct:Tic4jG4+DuCRXAuQT5vSg7ct

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28
PID 1440 wrote to memory of 1308	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b02bf9dcd11729c483de1adbf36e5ee00e33c13b756744cb290306749ae87632.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b02bf9dcd11729c483de1adbf36e5ee00e33c13b756744cb290306749ae87632.dll,#1
  2⤵
  PID:1308

memory/1308-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download