bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0

Analysis

max time kernel
38s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:16

Target

bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll
Size

44KB
MD5

5bb3dbe2d7e180f8d3c2523cb70c853e
SHA1

6684579a23460733e821e12eb9ebd2225d9f5d70
SHA256

bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0
SHA512

a83ca7819c68f4231cfc3708dddcf8e8e02454960e047f9cf142430676478c6e9ed7fbd70a7606d7514a2f46a45920e1a1f54b761b673f3927db9abd544c7745
SSDEEP

768:z3OHS8KOzom9bb/XALJ4tOLZord6yNObWAjOwMu0tC0xm28g02n6Orkozo1gv:yHZEmV7w5LZFpagOwMu0ojgN4o8gv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28
PID 1364 wrote to memory of 736	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll,#1
  2⤵
  PID:736

memory/736-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download