bd6b85963cfef459624669d29fb53e75f5631938a4397993afdaeb45a5719767

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:10

Target

bd6b85963cfef459624669d29fb53e75f5631938a4397993afdaeb45a5719767.dll
Size

400KB
MD5

7d400688dcb3db89f5a11bd6fe4e8310
SHA1

0ee686caabeefeeb743a334f83f9eac452cbb7a3
SHA256

bd6b85963cfef459624669d29fb53e75f5631938a4397993afdaeb45a5719767
SHA512

f51c09fd5d2ab6b3536e3b65b230e641bd9d023de248ffdeeb51dd0f972544899ef3512f34163fd5f34c561b040e3bdcfb193766dad42497e94cbbc6a558046a
SSDEEP

6144:lEx1RH174AW3oJfhiz0QQvzmxHK8o3qK4yfeXhqqQktzGJedqDsWbdkSD4:lG1V174ACcfhiwQwjtSSktzGEfWbd8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28
PID 968 wrote to memory of 952	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6b85963cfef459624669d29fb53e75f5631938a4397993afdaeb45a5719767.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6b85963cfef459624669d29fb53e75f5631938a4397993afdaeb45a5719767.dll,#1
  2⤵
  PID:952

memory/952-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download