bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051

Analysis

max time kernel
17s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:21

Target

bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll
Size

73KB
MD5

61fdfd41f537e81cd0a6bdbf0abfac2f
SHA1

4e1b057518548182a9c58cb5592f0b14cd526be8
SHA256

bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051
SHA512

9f6c2a915dac04c3ccc9feeef6e5bf107bdb52da1ea18ea3aace973e08ecc052ed70e6f2958e1e6a0b75928a0119d4409101a65e35b18f59f3dd8acf937d9dcb
SSDEEP

1536:IykzkagfZsew6GiUcWjmCyGUwUSg9CZZ0XFJRu0Pbq:IFzkaeAyUcWjmCy6OCZ+bbq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll,#1
  2⤵
  PID:1776

memory/1776-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1776-56-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1776-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1776-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download