b87d4afcd7c0dce79e65c451ec588954aedebb54d6b5e93126b030b9e72fda22

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:38

Target

b87d4afcd7c0dce79e65c451ec588954aedebb54d6b5e93126b030b9e72fda22.dll
Size

33KB
MD5

53a140852d922d37433129b8f2f29c0b
SHA1

211557fb9e0226c73ecfeb96f04daa23d366bec2
SHA256

b87d4afcd7c0dce79e65c451ec588954aedebb54d6b5e93126b030b9e72fda22
SHA512

c591593a2ee400b1e1c5c9d45143efc838b83f5e1a78d3433152e0e02954813c41fcb9ff12610b38acdef5a71ebdb014c70dbb032fce85d7f56062f7d40f5205
SSDEEP

768:m7v1b7TDuSxa/0xyDcl27l5+uMSVOiuGROkR9A:mz1b9a/3A47l5+uVFRFR+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b87d4afcd7c0dce79e65c451ec588954aedebb54d6b5e93126b030b9e72fda22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b87d4afcd7c0dce79e65c451ec588954aedebb54d6b5e93126b030b9e72fda22.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download